diff --git a/gpcm/friend.go b/gpcm/friend.go
index a46e7c9..74bbe81 100644
--- a/gpcm/friend.go
+++ b/gpcm/friend.go
@@ -417,13 +417,13 @@ func (g *GameSpySession) bestieMessage(command common.GameSpyCommand) {
 		msgMatchData.Reservation.LocalIP = 0
 		msgMatchData.Reservation.LocalPort = 0
 	} else if cmd == common.MatchResvOK || cmd == common.MatchResvDeny || cmd == common.MatchResvWait {
-		if toSession.ReservationPID != g.User.ProfileId || g.Reservation.Reservation == nil {
+		if toSession.ReservationPID != g.User.ProfileId || toSession.Reservation.Reservation == nil {
 			logging.Error(g.ModuleName, "Destination", aurora.Cyan(toProfileId), "has no reservation with the sender")
 			g.replyError(ErrMessage)
 			return
 		}
 
-		if g.Reservation.Version != msgMatchData.Version {
+		if toSession.Reservation.Version != msgMatchData.Version {
 			logging.Error(g.ModuleName, "Reservation version mismatch")
 			g.replyError(ErrMessage)
 			return
@@ -436,7 +436,7 @@ func (g *GameSpySession) bestieMessage(command common.GameSpyCommand) {
 				return
 			}
 
-			if !qr2.ProcessGPResvOK(msgMatchData.Version, *g.Reservation.Reservation, *msgMatchData.ResvOK, g.QR2IP, g.User.ProfileId, toSession.QR2IP, uint32(toProfileId)) {
+			if !qr2.ProcessGPResvOK(msgMatchData.Version, *toSession.Reservation.Reservation, *msgMatchData.ResvOK, g.QR2IP, g.User.ProfileId, toSession.QR2IP, uint32(toProfileId)) {
 				g.replyError(ErrMessage)
 				return
 			}
diff --git a/gpcm/login.go b/gpcm/login.go
index 19c619f..1475320 100644
--- a/gpcm/login.go
+++ b/gpcm/login.go
@@ -37,6 +37,13 @@ func generateProof(gpcmChallenge, nasChallenge, authToken, clientChallenge strin
 	return generateResponse(clientChallenge, nasChallenge, authToken, gpcmChallenge)
 }
 
+var msPublicKey = []byte{
+	0x00, 0xFD, 0x56, 0x04, 0x18, 0x2C, 0xF1, 0x75, 0x09, 0x21, 0x00, 0xC3, 0x08, 0xAE, 0x48, 0x39,
+	0x91, 0x1B, 0x6F, 0x9F, 0xA1, 0xD5, 0x3A, 0x95, 0xAF, 0x08, 0x33, 0x49, 0x47, 0x2B, 0x00, 0x01,
+	0x71, 0x31, 0x69, 0xB5, 0x91, 0xFF, 0xD3, 0x0C, 0xBF, 0x73, 0xDA, 0x76, 0x64, 0xBA, 0x8D, 0x0D,
+	0xF9, 0x5B, 0x4D, 0x11, 0x04, 0x44, 0x64, 0x35, 0xC0, 0xED, 0xA4, 0x2F,
+}
+
 func verifySignature(authToken string, signature string) uint32 {
 	sigBytes, err := common.Base64DwcEncoding.DecodeString(signature)
 	if err != nil || len(sigBytes) != 0x144 {
@@ -67,8 +74,6 @@ func verifySignature(authToken string, signature string) uint32 {
 	ngCertBlob = append(ngCertBlob, make([]byte, 0x3C)...)
 	ngCertBlobHash := sha1.Sum(ngCertBlob)
 
-	msPublicKey := []byte{0x00, 0xFD, 0x56, 0x04, 0x18, 0x2C, 0xF1, 0x75, 0x09, 0x21, 0x00, 0xC3, 0x08, 0xAE, 0x48, 0x39, 0x91, 0x1B, 0x6F, 0x9F, 0xA1, 0xD5, 0x3A, 0x95, 0xAF, 0x08, 0x33, 0x49, 0x47, 0x2B, 0x00, 0x01, 0x71, 0x31, 0x69, 0xB5, 0x91, 0xFF, 0xD3, 0x0C, 0xBF, 0x73, 0xDA, 0x76, 0x64, 0xBA, 0x8D, 0x0D, 0xF9, 0x5B, 0x4D, 0x11, 0x04, 0x44, 0x64, 0x35, 0xC0, 0xED, 0xA4, 0x2F}
-
 	if !verifyECDSA(msPublicKey, msSignature, ngCertBlobHash[:]) {
 		logging.Error("GPCM", "NG cert verify failed")
 		return 0
@@ -263,6 +268,11 @@ func (g *GameSpySession) login(command common.GameSpyCommand) {
 }
 
 func (g *GameSpySession) exLogin(command common.GameSpyCommand) {
+	if !g.LoggedIn {
+		logging.Warn(g.ModuleName, "Ignoring exlogin before login")
+		return
+	}
+
 	payloadVer, payloadVerExists := command.OtherValues["payload_ver"]
 	signature, signatureExists := command.OtherValues["wwfc_sig"]
 	deviceId := uint32(0)