Okay that makes sense. I guess my thinking was it would be better to have a nearly blank project running the server code without having to load in any assets or things like that. I suppose it doesn't really matter, it was just that my server is designed to be the only host that can exist for Xbridge, since it's only being used to share people's custom level creations and also function as a social network.
My current solution for this is for my "server" to look up a specific file on clay.io that only my account has access to, and if it returns the right data, then it proceeds as the host. otherwise anyone else would just get disconnected immediately with a message stating "the server is currently down for maintenance" although in reality, it just won't let any other computer but mine Host.
My account management works in a similar way in that it checks the server to see if the user name exists in the dictionary object, and if not, adds it and tells the client's computer to upload that name to clay.io as their login. so technically, its not really possible for 2 people to have the same name, and this kinda gets around the whole duplicates thing where it adds a 2 or 3 etc to the player alias. it never allows two people with the same name to connect, and since their names are linked to their clay.io account, I don't believe it would be very easy to hack someone's Xbridge account without having to hack their clay.io account first.
I imagine there are far better ways to do this. I just don't really know any coding outside of C2 or python. I read something about mysql being an excellent way to store player accounts with encryption. I just haven't spent any time looking into that just yet.
A small group of us will be doing some more tests next weekend if you want to jump in and try it out. I'm sure you are a busy man, but if you're interested, feel free to PM me, and I'll send you a link.