TLS on every web page, separated player account, credentials hashed at rest