Add server-side enforcement of the 'fast' privilege; also fix client checking 'fly' instead of 'fast'