Security improvements

[szokodiakos]

• Require ENV placed ID to open the display view.
• Include a changing ID in the controller URL, so only people who are there can access the controller
• Throw out first person in queue after 30 secs of not starting the game.

[cxcorp]

Throw out first person in queue after 30 secs of not starting the game.

Implementing this on the backend would require some pervasive or possibly fragile changes to the state class because of all possible cases.

Do we need to implement this on the backend? On the frontend, this would be quite simple to implement with a timer and page refresh, but is there a threat of someone showing up with a laptop, patching it out and blocking the queue?