They can do that, but would be nice to add spice to password to stop others from brute forcing.
password = "password"
salt = "123nthuaoentheoau,23p3u3tn,nahpnthptn2p3tnhnth4nh3nt4h3n4h2n23m23tnmoetntneiud"
If =/ "Password & Salt" then "sorry, password doesn't match"
But salt needs to be protected from viewer looking at source because you can plainly view all variables in source.
Already he can create room name and create a password so that others can join. This shoudn't be too hard to implement.
The protected variable has many uses outside multiplayer plugin - lol. I've been requesting it for awhile.