In the last days I've been changing the game architecture in order for all requests to pass through the server. For a matter of simplicity I haven't added any security related checks in the messages sent by the players (for now...), but all update messages coming from a source other than the server are ignored.
This change hasn't been very easy because there were a lot of mixed messaging types and the identification of the player to which the data received belonged to relied only on the sender of the message. So, I had to add a way to identify the player to which an update message corresponds since all data received now comes from the server.
There is still some polishing to do in order for the game to run smoothly for all players. For now the host of the game is the only player able have a good gameplay experience.
Hope to post here some more news, hopefully of the completion, about this task during this week.