yes, net_serverAllowHijacking 0 fixed this problem
just put this in your cvar
net_serverAllowHijacking 0