When playing in multiplayer and a player uses a password protected room, ALL players should be required to put in the required password to enter the room, even other players who have friends in that room. In other words, players who do not have the password to a multiplayer room should not be allowed to enter the room at all. Sometimes there are multiplayer rooms set up for particular friends who have the password but because someone else has entered through a proverbial “back door” they take the place of the player who the spot was meant for.
Daniel, if it helps, I found the "back door" only works if the original person who created the room is still in charge. If thhe original persion leaves, the password kicks in. I did some testing on this with a full room. Everyone in the room was on my "friends" list and there were a few changes to the person in charge - the "back door" didn't come back, even when the original person was back in charge of the room.