diff --git a/group.go b/group.go
index c98af49..cb48f60 100644
--- a/group.go
+++ b/group.go
@@ -231,6 +231,9 @@ func addClient(name string, c client) (*group, error) {
 
 func delClient(c client) {
 	g := c.Group()
+	if g == nil {
+		return
+	}
 	g.mu.Lock()
 	defer g.mu.Unlock()
 
diff --git a/static/sfu.js b/static/sfu.js
index a3bd7ba..3e00ac1 100644
--- a/static/sfu.js
+++ b/static/sfu.js
@@ -612,12 +612,15 @@ function serverConnect() {
             let up = getUserPass();
             try {
                 send({
-                    type: 'handshake',
+                    type: 'login',
                     id: myid,
-                    group: group,
                     username: up.username,
                     password: up.password,
                 })
+                send({
+                    type: 'join',
+                    group: group,
+                })
                 sendRequest(document.getElementById('requestselect').value);
                 } catch(e) {
                     console.error(e);
diff --git a/webclient.go b/webclient.go
index 46054d2..355972c 100644
--- a/webclient.go
+++ b/webclient.go
@@ -619,13 +619,31 @@ func startClient(conn *websocket.Conn) (err error) {
 		return
 	}
 
-	if m.Type != "handshake" {
+	if m.Type != "login" {
+		conn.WriteMessage(websocket.CloseMessage,
+			websocket.FormatCloseMessage(
+				websocket.CloseProtocolError,
+				"you must login first",
+			),
+		)
 		conn.Close()
 		return
 	}
 
 	if strings.ContainsRune(m.Username, ' ') {
-		err = userError("don't put spaces in your username")
+		// at this point, the writer is not running yet, so format
+		// the message ourselves
+		conn.WriteJSON(clientMessage{
+			Type:  "error",
+			Value: "don't put spaces in your username",
+		})
+		conn.WriteMessage(websocket.CloseMessage,
+			websocket.FormatCloseMessage(
+				websocket.CloseProtocolError,
+				"don't put spaces in your username",
+			),
+		)
+		conn.Close()
 		return
 	}
 
@@ -665,6 +683,15 @@ func startClient(conn *websocket.Conn) (err error) {
 	c.writerDone = make(chan struct{})
 	go clientWriter(conn, c.writeCh, c.writerDone)
 
+	err = conn.ReadJSON(&m)
+	if err != nil {
+		return err
+	}
+
+	if m.Type != "join" {
+		return protocolError("you must join a group first")
+	}
+
 	g, err := addClient(m.Group, c)
 	if err != nil {
 		return