tictactoe: Enforce only legal moves with regard to team membership

Rejecting any attempt to move if a player cannot be found from the
current session, or if the player is not on the right team, etc.

Commit includes testing.