diff --git a/common/cvardef.h b/common/cvardef.h
index 247a231c..57d9517b 100644
--- a/common/cvardef.h
+++ b/common/cvardef.h
@@ -25,7 +25,7 @@
 #define FCVAR_PRINTABLEONLY		(1<<7)	// This cvar's string cannot contain unprintable characters ( e.g., used for player name etc ).
 #define FCVAR_UNLOGGED		(1<<8)	// If this is a FCVAR_SERVER, don't log changes to the log file / console if we are creating a log
 #define FCVAR_NOEXTRAWHITEPACE	(1<<9)	// strip trailing/leading white space from this cvar
-#define FCVAR_LOCALONLY		(1<<10)
+#define FCVAR_PRIVILEGED	(1<<10) // only available in privileged mode
 
 #define FCVAR_LATCH			(1<<11)	// notify client what this cvar will be applied only after server restart (but don't does more nothing)
 #define FCVAR_GLCONFIG		(1<<12)	// write it into <renderer>.cfg(see RefAPI)
diff --git a/engine/client/cl_main.c b/engine/client/cl_main.c
index 27d6755f..f9695a3c 100644
--- a/engine/client/cl_main.c
+++ b/engine/client/cl_main.c
@@ -30,7 +30,7 @@ GNU General Public License for more details.
 #define CL_TEST_RETRIES_NORESPONCE	2
 #define CL_TEST_RETRIES		5
 
-CVAR_DEFINE_AUTO( mp_decals, "300", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "decals limit in multiplayer" );
+CVAR_DEFINE_AUTO( mp_decals, "300", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "decals limit in multiplayer" );
 CVAR_DEFINE_AUTO( dev_overview, "0", 0, "draw level in overview-mode" );
 CVAR_DEFINE_AUTO( cl_resend, "6.0", 0, "time to resend connect" );
 CVAR_DEFINE_AUTO( cl_allow_download, "1", FCVAR_ARCHIVE, "allow to downloading resources from the server" );
@@ -2820,13 +2820,13 @@ void CL_InitLocal( void )
 	cl_nodelta = Cvar_Get ("cl_nodelta", "0", 0, "disable delta-compression for server messages" );
 	cl_idealpitchscale = Cvar_Get( "cl_idealpitchscale", "0.8", 0, "how much to look up/down slopes and stairs when not using freelook" );
 	cl_solid_players = Cvar_Get( "cl_solid_players", "1", 0, "Make all players not solid (can't traceline them)" );
-	cl_interp = Cvar_Get( "ex_interp", "0.1", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "Interpolate object positions starting this many seconds in past" );
+	cl_interp = Cvar_Get( "ex_interp", "0.1", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "Interpolate object positions starting this many seconds in past" );
 	cl_timeout = Cvar_Get( "cl_timeout", "60", 0, "connect timeout (in-seconds)" );
 	cl_charset = Cvar_Get( "cl_charset", "utf-8", FCVAR_ARCHIVE, "1-byte charset to use (iconv style)" );
 	hud_utf8 = Cvar_Get( "hud_utf8", "0", FCVAR_ARCHIVE, "Use utf-8 encoding for hud text" );
 
-	rcon_client_password = Cvar_Get( "rcon_password", "", FCVAR_LOCALONLY, "remote control client password" );
-	rcon_address = Cvar_Get( "rcon_address", "", FCVAR_LOCALONLY, "remote control address" );
+	rcon_client_password = Cvar_Get( "rcon_password", "", FCVAR_PRIVILEGED, "remote control client password" );
+	rcon_address = Cvar_Get( "rcon_address", "", FCVAR_PRIVILEGED, "remote control address" );
 
 	cl_trace_messages = Cvar_Get( "cl_trace_messages", "0", FCVAR_ARCHIVE|FCVAR_CHEAT, "enable message names tracing (good for developers)");
 
diff --git a/engine/client/cl_mobile.c b/engine/client/cl_mobile.c
index bbc7441f..bef39987 100644
--- a/engine/client/cl_mobile.c
+++ b/engine/client/cl_mobile.c
@@ -125,8 +125,8 @@ qboolean Mobile_Init( void )
 		success = true;
 
 	Cmd_AddCommand( "vibrate", (xcommand_t)Vibrate_f, "Vibrate for specified time");
-	vibration_length = Cvar_Get( "vibration_length", "1.0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "Vibration length");
-	vibration_enable = Cvar_Get( "vibration_enable", "1", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "Enable vibration");
+	vibration_length = Cvar_Get( "vibration_length", "1.0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "Vibration length");
+	vibration_enable = Cvar_Get( "vibration_enable", "1", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "Enable vibration");
 
 	return success;
 }
diff --git a/engine/client/in_joy.c b/engine/client/in_joy.c
index 73a7ef31..cac36215 100644
--- a/engine/client/in_joy.c
+++ b/engine/client/in_joy.c
@@ -380,32 +380,32 @@ Main init procedure
 */
 void Joy_Init( void )
 {
-	joy_pitch   = Cvar_Get( "joy_pitch",   "100.0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "joystick pitch sensitivity" );
-	joy_yaw     = Cvar_Get( "joy_yaw",     "100.0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "joystick yaw sensitivity" );
-	joy_side    = Cvar_Get( "joy_side",    "1.0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "joystick side sensitivity. Values from -1.0 to 1.0" );
-	joy_forward = Cvar_Get( "joy_forward", "1.0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "joystick forward sensitivity. Values from -1.0 to 1.0" );
+	joy_pitch   = Cvar_Get( "joy_pitch",   "100.0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "joystick pitch sensitivity" );
+	joy_yaw     = Cvar_Get( "joy_yaw",     "100.0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "joystick yaw sensitivity" );
+	joy_side    = Cvar_Get( "joy_side",    "1.0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "joystick side sensitivity. Values from -1.0 to 1.0" );
+	joy_forward = Cvar_Get( "joy_forward", "1.0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "joystick forward sensitivity. Values from -1.0 to 1.0" );
 
-	joy_lt_threshold = Cvar_Get( "joy_lt_threshold", "16384", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "left trigger threshold. Value from 0 to 32767");
-	joy_rt_threshold = Cvar_Get( "joy_rt_threshold", "16384", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "right trigger threshold. Value from 0 to 32767" );
+	joy_lt_threshold = Cvar_Get( "joy_lt_threshold", "16384", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "left trigger threshold. Value from 0 to 32767");
+	joy_rt_threshold = Cvar_Get( "joy_rt_threshold", "16384", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "right trigger threshold. Value from 0 to 32767" );
 
 	// emit a key event at 75% axis move
-	joy_side_key_threshold = Cvar_Get( "joy_side_key_threshold", "24576", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "side axis key event emit threshold. Value from 0 to 32767" );
-	joy_forward_key_threshold = Cvar_Get( "joy_forward_key_threshold", "24576", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "forward axis key event emit threshold. Value from 0 to 32767");
+	joy_side_key_threshold = Cvar_Get( "joy_side_key_threshold", "24576", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "side axis key event emit threshold. Value from 0 to 32767" );
+	joy_forward_key_threshold = Cvar_Get( "joy_forward_key_threshold", "24576", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "forward axis key event emit threshold. Value from 0 to 32767");
 
 	// by default, we rely on deadzone detection come from system, but some glitchy devices report false deadzones
-	joy_side_deadzone = Cvar_Get( "joy_side_deadzone", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "side axis deadzone. Value from 0 to 32767" );
-	joy_forward_deadzone = Cvar_Get( "joy_forward_deadzone", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "forward axis deadzone. Value from 0 to 32767");
-	joy_pitch_deadzone = Cvar_Get( "joy_pitch_deadzone", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "pitch axis deadzone. Value from 0 to 32767");
-	joy_yaw_deadzone = Cvar_Get( "joy_yaw_deadzone", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "yaw axis deadzone. Value from 0 to 32767" );
+	joy_side_deadzone = Cvar_Get( "joy_side_deadzone", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "side axis deadzone. Value from 0 to 32767" );
+	joy_forward_deadzone = Cvar_Get( "joy_forward_deadzone", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "forward axis deadzone. Value from 0 to 32767");
+	joy_pitch_deadzone = Cvar_Get( "joy_pitch_deadzone", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "pitch axis deadzone. Value from 0 to 32767");
+	joy_yaw_deadzone = Cvar_Get( "joy_yaw_deadzone", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "yaw axis deadzone. Value from 0 to 32767" );
 
-	joy_axis_binding = Cvar_Get( "joy_axis_binding", "sfpyrl", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "axis hardware id to engine inner axis binding, "
+	joy_axis_binding = Cvar_Get( "joy_axis_binding", "sfpyrl", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "axis hardware id to engine inner axis binding, "
 		"s - side, f - forward, y - yaw, p - pitch, r - left trigger, l - right trigger" );
 	joy_found   = Cvar_Get( "joy_found", "0", FCVAR_READ_ONLY, "is joystick is connected" );
 	// we doesn't loaded config.cfg yet, so this cvar is not archive.
 	// change by +set joy_index in cmdline
 	joy_index   = Cvar_Get( "joy_index", "0", FCVAR_READ_ONLY, "current active joystick" );
 
-	joy_enable = Cvar_Get( "joy_enable", "1", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "enable joystick" );
+	joy_enable = Cvar_Get( "joy_enable", "1", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "enable joystick" );
 
 	if( Sys_CheckParm( "-nojoy" ))
 	{
diff --git a/engine/client/in_touch.c b/engine/client/in_touch.c
index 600bb9cf..1505408f 100644
--- a/engine/client/in_touch.c
+++ b/engine/client/in_touch.c
@@ -1037,35 +1037,35 @@ void Touch_Init( void )
 	Cmd_AddRestrictedCommand( "touch_toggleselection", Touch_ToggleSelection_f, "toggle vidibility on selected button in editor" );
 
 	// not saved, just runtime state for scripting
-	touch_in_menu = Cvar_Get( "touch_in_menu", "0", FCVAR_LOCALONLY, "draw touch in menu (for internal use only)" );
+	touch_in_menu = Cvar_Get( "touch_in_menu", "0", FCVAR_PRIVILEGED, "draw touch in menu (for internal use only)" );
 
 	// sensitivity configuration
-	touch_forwardzone = Cvar_Get( "touch_forwardzone", "0.06", FCVAR_LOCALONLY, "forward touch zone" );
-	touch_sidezone = Cvar_Get( "touch_sidezone", "0.06", FCVAR_LOCALONLY, "side touch zone" );
-	touch_pitch = Cvar_Get( "touch_pitch", "90", FCVAR_LOCALONLY, "touch pitch sensitivity" );
-	touch_yaw = Cvar_Get( "touch_yaw", "120", FCVAR_LOCALONLY, "touch yaw sensitivity" );
-	touch_nonlinear_look = Cvar_Get( "touch_nonlinear_look", "0", FCVAR_LOCALONLY, "enable nonlinear touch look" );
-	touch_pow_factor = Cvar_Get( "touch_pow_factor", "1.3", FCVAR_LOCALONLY, "set > 1 to enable" );
-	touch_pow_mult = Cvar_Get( "touch_pow_mult", "400.0", FCVAR_LOCALONLY, "power multiplier, usually 200-1000" );
-	touch_exp_mult = Cvar_Get( "touch_exp_mult", "0", FCVAR_LOCALONLY, "exponent multiplier, usually 20-200, 0 to disable" );
+	touch_forwardzone = Cvar_Get( "touch_forwardzone", "0.06", FCVAR_PRIVILEGED, "forward touch zone" );
+	touch_sidezone = Cvar_Get( "touch_sidezone", "0.06", FCVAR_PRIVILEGED, "side touch zone" );
+	touch_pitch = Cvar_Get( "touch_pitch", "90", FCVAR_PRIVILEGED, "touch pitch sensitivity" );
+	touch_yaw = Cvar_Get( "touch_yaw", "120", FCVAR_PRIVILEGED, "touch yaw sensitivity" );
+	touch_nonlinear_look = Cvar_Get( "touch_nonlinear_look", "0", FCVAR_PRIVILEGED, "enable nonlinear touch look" );
+	touch_pow_factor = Cvar_Get( "touch_pow_factor", "1.3", FCVAR_PRIVILEGED, "set > 1 to enable" );
+	touch_pow_mult = Cvar_Get( "touch_pow_mult", "400.0", FCVAR_PRIVILEGED, "power multiplier, usually 200-1000" );
+	touch_exp_mult = Cvar_Get( "touch_exp_mult", "0", FCVAR_PRIVILEGED, "exponent multiplier, usually 20-200, 0 to disable" );
 
 	// touch.cfg
-	touch_grid_count = Cvar_Get( "touch_grid_count", "50", FCVAR_LOCALONLY, "touch grid count" );
-	touch_grid_enable = Cvar_Get( "touch_grid_enable", "1", FCVAR_LOCALONLY, "enable touch grid" );
-	touch_config_file = Cvar_Get( "touch_config_file", "touch.cfg", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "current touch profile file" );
-	touch_precise_amount = Cvar_Get( "touch_precise_amount", "0.5", FCVAR_LOCALONLY, "sensitivity multiplier for precise-look" );
+	touch_grid_count = Cvar_Get( "touch_grid_count", "50", FCVAR_PRIVILEGED, "touch grid count" );
+	touch_grid_enable = Cvar_Get( "touch_grid_enable", "1", FCVAR_PRIVILEGED, "enable touch grid" );
+	touch_config_file = Cvar_Get( "touch_config_file", "touch.cfg", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "current touch profile file" );
+	touch_precise_amount = Cvar_Get( "touch_precise_amount", "0.5", FCVAR_PRIVILEGED, "sensitivity multiplier for precise-look" );
 	touch_highlight_r = Cvar_Get( "touch_highlight_r", "1.0", 0, "highlight r color" );
 	touch_highlight_g = Cvar_Get( "touch_highlight_g", "1.0", 0, "highlight g color" );
 	touch_highlight_b = Cvar_Get( "touch_highlight_b", "1.0", 0, "highlight b color" );
 	touch_highlight_a = Cvar_Get( "touch_highlight_a", "1.0", 0, "highlight alpha" );
-	touch_dpad_radius = Cvar_Get( "touch_dpad_radius", "1.0", FCVAR_LOCALONLY, "dpad radius multiplier" );
-	touch_joy_radius = Cvar_Get( "touch_joy_radius", "1.0", FCVAR_LOCALONLY, "joy radius multiplier" );
-	touch_move_indicator = Cvar_Get( "touch_move_indicator", "0.0", FCVAR_LOCALONLY, "indicate move events (0 to disable)" );
-	touch_joy_texture = Cvar_Get( "touch_joy_texture", "touch_default/joy.tga", FCVAR_LOCALONLY, "texture for move indicator");
+	touch_dpad_radius = Cvar_Get( "touch_dpad_radius", "1.0", FCVAR_PRIVILEGED, "dpad radius multiplier" );
+	touch_joy_radius = Cvar_Get( "touch_joy_radius", "1.0", FCVAR_PRIVILEGED, "joy radius multiplier" );
+	touch_move_indicator = Cvar_Get( "touch_move_indicator", "0.0", FCVAR_PRIVILEGED, "indicate move events (0 to disable)" );
+	touch_joy_texture = Cvar_Get( "touch_joy_texture", "touch_default/joy.tga", FCVAR_PRIVILEGED, "texture for move indicator");
 
 	// input devices cvar
-	touch_enable = Cvar_Get( "touch_enable", DEFAULT_TOUCH_ENABLE, FCVAR_ARCHIVE | FCVAR_LOCALONLY, "enable touch controls" );
-	touch_emulate = Cvar_Get( "touch_emulate", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "emulate touch with mouse" );
+	touch_enable = Cvar_Get( "touch_enable", DEFAULT_TOUCH_ENABLE, FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "enable touch controls" );
+	touch_emulate = Cvar_Get( "touch_emulate", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "emulate touch with mouse" );
 
 	/// TODO: touch sdl platform
 	// SDL_SetHint( SDL_HINT_ANDROID_SEPARATE_MOUSE_AND_TOUCH, "1" );
diff --git a/engine/client/input.c b/engine/client/input.c
index 9546bb17..35996d7d 100644
--- a/engine/client/input.c
+++ b/engine/client/input.c
@@ -111,14 +111,14 @@ IN_StartupMouse
 */
 void IN_StartupMouse( void )
 {
-	m_ignore = Cvar_Get( "m_ignore", DEFAULT_M_IGNORE, FCVAR_ARCHIVE | FCVAR_LOCALONLY, "ignore mouse events" );
+	m_ignore = Cvar_Get( "m_ignore", DEFAULT_M_IGNORE, FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "ignore mouse events" );
 
-	m_enginemouse = Cvar_Get( "m_enginemouse", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "read mouse events in engine instead of client" );
-	m_enginesens = Cvar_Get( "m_enginesens", "0.3", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "mouse sensitivity, when m_enginemouse enabled" );
-	m_pitch = Cvar_Get( "m_pitch", "0.022", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "mouse pitch value" );
-	m_yaw = Cvar_Get( "m_yaw", "0.022", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "mouse yaw value" );
-	look_filter = Cvar_Get( "look_filter", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "filter look events making it smoother" );
-	m_rawinput = Cvar_Get( "m_rawinput", "1", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "enable mouse raw input" );
+	m_enginemouse = Cvar_Get( "m_enginemouse", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "read mouse events in engine instead of client" );
+	m_enginesens = Cvar_Get( "m_enginesens", "0.3", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "mouse sensitivity, when m_enginemouse enabled" );
+	m_pitch = Cvar_Get( "m_pitch", "0.022", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "mouse pitch value" );
+	m_yaw = Cvar_Get( "m_yaw", "0.022", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "mouse yaw value" );
+	look_filter = Cvar_Get( "look_filter", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "filter look events making it smoother" );
+	m_rawinput = Cvar_Get( "m_rawinput", "1", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "enable mouse raw input" );
 
 	// You can use -nomouse argument to prevent using mouse from client
 	// -noenginemouse will disable all mouse input
@@ -462,9 +462,9 @@ IN_Init
 */
 void IN_Init( void )
 {
-	cl_forwardspeed	= Cvar_Get( "cl_forwardspeed", "400", FCVAR_ARCHIVE | FCVAR_CLIENTDLL | FCVAR_LOCALONLY, "Default forward move speed" );
-	cl_backspeed	= Cvar_Get( "cl_backspeed", "400", FCVAR_ARCHIVE | FCVAR_CLIENTDLL | FCVAR_LOCALONLY, "Default back move speed"  );
-	cl_sidespeed	= Cvar_Get( "cl_sidespeed", "400", FCVAR_ARCHIVE | FCVAR_CLIENTDLL | FCVAR_LOCALONLY, "Default side move speed"  );
+	cl_forwardspeed	= Cvar_Get( "cl_forwardspeed", "400", FCVAR_ARCHIVE | FCVAR_CLIENTDLL | FCVAR_PRIVILEGED, "Default forward move speed" );
+	cl_backspeed	= Cvar_Get( "cl_backspeed", "400", FCVAR_ARCHIVE | FCVAR_CLIENTDLL | FCVAR_PRIVILEGED, "Default back move speed"  );
+	cl_sidespeed	= Cvar_Get( "cl_sidespeed", "400", FCVAR_ARCHIVE | FCVAR_CLIENTDLL | FCVAR_PRIVILEGED, "Default side move speed"  );
 
 	if( !Host_IsDedicated() )
 	{
diff --git a/engine/client/keys.c b/engine/client/keys.c
index 0c2e01a1..9ab10504 100644
--- a/engine/client/keys.c
+++ b/engine/client/keys.c
@@ -522,8 +522,8 @@ void Key_Init( void )
 	// setup default binding. "unbindall" from config.cfg will be reset it
 	for( kn = keynames; kn->name; kn++ ) Key_SetBinding( kn->keynum, kn->binding );
 
-	osk_enable = Cvar_Get( "osk_enable", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "enable built-in on-screen keyboard" );
-	key_rotate = Cvar_Get( "key_rotate", "0", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "rotate arrow keys (0-3)" );
+	osk_enable = Cvar_Get( "osk_enable", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "enable built-in on-screen keyboard" );
+	key_rotate = Cvar_Get( "key_rotate", "0", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "rotate arrow keys (0-3)" );
 
 }
 
diff --git a/engine/client/s_main.c b/engine/client/s_main.c
index da43c2fd..5db22e3b 100644
--- a/engine/client/s_main.c
+++ b/engine/client/s_main.c
@@ -35,18 +35,18 @@ int		total_channels;
 int		soundtime;	// sample PAIRS
 int   		paintedtime; 	// sample PAIRS
 
-static CVAR_DEFINE( s_volume, "volume", "0.7", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "sound volume" );
-CVAR_DEFINE( s_musicvolume, "MP3Volume", "1.0", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "background music volume" );
-static CVAR_DEFINE( s_mixahead, "_snd_mixahead", "0.12", FCVAR_LOCALONLY, "how much sound to mix ahead of time" );
-static CVAR_DEFINE_AUTO( s_show, "0", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "show playing sounds" );
-CVAR_DEFINE_AUTO( s_lerping, "0", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "apply interpolation to sound output" );
-static CVAR_DEFINE( s_ambient_level, "ambient_level", "0.3", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "volume of environment noises (water and wind)" );
-static CVAR_DEFINE( s_ambient_fade, "ambient_fade", "1000", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "rate of volume fading when client is moving" );
-static CVAR_DEFINE_AUTO( s_combine_sounds, "0", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "combine channels with same sounds" );
-CVAR_DEFINE_AUTO( snd_mute_losefocus, "1", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "silence the audio when game window loses focus" );
+static CVAR_DEFINE( s_volume, "volume", "0.7", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "sound volume" );
+CVAR_DEFINE( s_musicvolume, "MP3Volume", "1.0", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "background music volume" );
+static CVAR_DEFINE( s_mixahead, "_snd_mixahead", "0.12", FCVAR_PRIVILEGED, "how much sound to mix ahead of time" );
+static CVAR_DEFINE_AUTO( s_show, "0", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "show playing sounds" );
+CVAR_DEFINE_AUTO( s_lerping, "0", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "apply interpolation to sound output" );
+static CVAR_DEFINE( s_ambient_level, "ambient_level", "0.3", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "volume of environment noises (water and wind)" );
+static CVAR_DEFINE( s_ambient_fade, "ambient_fade", "1000", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "rate of volume fading when client is moving" );
+static CVAR_DEFINE_AUTO( s_combine_sounds, "0", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "combine channels with same sounds" );
+CVAR_DEFINE_AUTO( snd_mute_losefocus, "1", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "silence the audio when game window loses focus" );
 CVAR_DEFINE_AUTO( s_test, "0", 0, "engine developer cvar for quick testing new features" );
-CVAR_DEFINE_AUTO( s_samplecount, "0", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "sample count (0 for default value)" );
-CVAR_DEFINE_AUTO( s_warn_late_precache, "0", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "warn about late precached sounds on client-side" );
+CVAR_DEFINE_AUTO( s_samplecount, "0", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "sample count (0 for default value)" );
+CVAR_DEFINE_AUTO( s_warn_late_precache, "0", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "warn about late precached sounds on client-side" );
 
 /*
 =============================================================================
diff --git a/engine/common/cmd.c b/engine/common/cmd.c
index 489a8e61..4de7bbb3 100644
--- a/engine/common/cmd.c
+++ b/engine/common/cmd.c
@@ -727,7 +727,7 @@ Cmd_AddRestrictedCommand
 */
 void Cmd_AddRestrictedCommand( const char *cmd_name, xcommand_t function, const char *cmd_desc )
 {
-	Cmd_AddCommandEx( __FUNCTION__, cmd_name, function, cmd_desc, CMD_LOCALONLY );
+	Cmd_AddCommandEx( __FUNCTION__, cmd_name, function, cmd_desc, CMD_PRIVILEGED );
 }
 
 /*
@@ -752,7 +752,7 @@ int GAME_EXPORT Cmd_AddClientCommand( const char *cmd_name, xcommand_t function
 	// a1ba: try to mitigate outdated client.dll vulnerabilities
 	if( !Q_stricmp( cmd_name, "motd_write" ))
 	{
-		flags |= CMD_LOCALONLY;
+		flags |= CMD_PRIVILEGED;
 	}
 
 	return Cmd_AddCommandEx( __FUNCTION__, cmd_name, function, "client command", flags );
@@ -945,7 +945,7 @@ static qboolean Cmd_ShouldAllowCommand( cmd_t *cmd, qboolean isPrivileged )
 		return true;
 
 	// never allow local only commands from remote
-	if( FBitSet( cmd->flags, CMD_LOCALONLY ))
+	if( FBitSet( cmd->flags, CMD_PRIVILEGED ))
 		return false;
 
 	// allow engine commands if user don't mind
diff --git a/engine/common/common.c b/engine/common/common.c
index 39cc405c..06634937 100644
--- a/engine/common/common.c
+++ b/engine/common/common.c
@@ -888,7 +888,7 @@ cvar_t *pfnCvar_RegisterClientVariable( const char *szName, const char *szValue,
 {
 	// a1ba: try to mitigate outdated client.dll vulnerabilities
 	if( !Q_stricmp( szName, "motdfile" ))
-		flags |= FCVAR_LOCALONLY;
+		flags |= FCVAR_PRIVILEGED;
 
 	if( FBitSet( flags, FCVAR_GLCONFIG ))
 		return (cvar_t *)Cvar_Get( szName, szValue, flags, va( CVAR_GLCONFIG_DESCRIPTION, szName ));
diff --git a/engine/common/common.h b/engine/common/common.h
index 6f5def15..59d0a346 100644
--- a/engine/common/common.h
+++ b/engine/common/common.h
@@ -465,8 +465,9 @@ extern sysinfo_t	SI;
 #define CMD_SERVERDLL	BIT( 0 )		// added by server.dll
 #define CMD_CLIENTDLL	BIT( 1 )		// added by client.dll
 #define CMD_GAMEUIDLL	BIT( 2 )		// added by GameUI.dll
-#define CMD_LOCALONLY	BIT( 3 )		// restricted from server commands
-#define CMD_REFDLL		BIT( 4 )		// added by ref.dll
+#define CMD_PRIVILEGED	BIT( 3 )		// only available in privileged mode
+#define CMD_FILTERABLE  BIT( 4 )		// filtered in unprivileged mode if cl_filterstuffcmd is 1
+#define CMD_REFDLL	BIT( 5 )		// added by ref.dll
 
 typedef void (*xcommand_t)( void );
 
diff --git a/engine/common/cvar.c b/engine/common/cvar.c
index 48a3d6e9..a421e01c 100644
--- a/engine/common/cvar.c
+++ b/engine/common/cvar.c
@@ -95,7 +95,7 @@ const char *Cvar_BuildAutoDescription( int flags )
 	if( FBitSet( flags, FCVAR_PROTECTED ))
 		Q_strncat( desc, "protected ", sizeof( desc ));
 
-	if( FBitSet( flags, FCVAR_LOCALONLY ))
+	if( FBitSet( flags, FCVAR_PRIVILEGED ))
 		Q_strncat( desc, "privileged ", sizeof( desc ));
 
 	Q_strncat( desc, "cvar", sizeof( desc ));
@@ -769,7 +769,7 @@ static qboolean Cvar_ShouldSetCvar( convar_t *v, qboolean isPrivileged )
 	if( isPrivileged )
 		return true;
 
-	if( v->flags & FCVAR_LOCALONLY )
+	if( v->flags & FCVAR_PRIVILEGED )
 		return false;
 
 	if( cl_filterstuffcmd.value <= 0.0f )
@@ -989,7 +989,7 @@ Reads in all archived cvars
 void Cvar_Init( void )
 {
 	cvar_vars = NULL;
-	cmd_scripting = Cvar_Get( "cmd_scripting", "0", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "enable simple condition checking and variable operations" );
+	cmd_scripting = Cvar_Get( "cmd_scripting", "0", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "enable simple condition checking and variable operations" );
 	Cvar_RegisterVariable (&host_developer); // early registering for dev
 
 	Cmd_AddRestrictedCommand( "setgl", Cvar_SetGL_f, "change the value of a opengl variable" );	// OBSOLETE
diff --git a/engine/common/host.c b/engine/common/host.c
index c0a63d68..e77a8cb6 100644
--- a/engine/common/host.c
+++ b/engine/common/host.c
@@ -52,7 +52,7 @@ struct tests_stats_s tests_stats;
 
 CVAR_DEFINE( host_developer, "developer", "0", 0, "engine is in development-mode" );
 CVAR_DEFINE_AUTO( sys_ticrate, "100", 0, "framerate in dedicated mode" );
-CVAR_DEFINE_AUTO( cl_filterstuffcmd, "1", FCVAR_ARCHIVE | FCVAR_LOCALONLY, "filter commands coming from server" );
+CVAR_DEFINE_AUTO( cl_filterstuffcmd, "1", FCVAR_ARCHIVE | FCVAR_PRIVILEGED, "filter commands coming from server" );
 
 convar_t	*host_serverstate;
 convar_t	*host_gameloaded;
@@ -1088,9 +1088,9 @@ int EXPORT Host_Main( int argc, char **argv, const char *progname, int bChangeGa
 
 	Cvar_RegisterVariable( &cl_filterstuffcmd );
 	host_serverstate = Cvar_Get( "host_serverstate", "0", FCVAR_READ_ONLY, "displays current server state" );
-	host_maxfps = Cvar_Get( "fps_max", "72", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "host fps upper limit" );
-	host_framerate = Cvar_Get( "host_framerate", "0", FCVAR_LOCALONLY, "locks frame timing to this value in seconds" );
-	host_sleeptime = Cvar_Get( "sleeptime", "1", FCVAR_ARCHIVE|FCVAR_LOCALONLY, "milliseconds to sleep for each frame. higher values reduce fps accuracy" );
+	host_maxfps = Cvar_Get( "fps_max", "72", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "host fps upper limit" );
+	host_framerate = Cvar_Get( "host_framerate", "0", FCVAR_PRIVILEGED, "locks frame timing to this value in seconds" );
+	host_sleeptime = Cvar_Get( "sleeptime", "1", FCVAR_ARCHIVE|FCVAR_PRIVILEGED, "milliseconds to sleep for each frame. higher values reduce fps accuracy" );
 	host_gameloaded = Cvar_Get( "host_gameloaded", "0", FCVAR_READ_ONLY, "inidcates a loaded game.dll" );
 	host_clientloaded = Cvar_Get( "host_clientloaded", "0", FCVAR_READ_ONLY, "inidcates a loaded client.dll" );
 	host_limitlocal = Cvar_Get( "host_limitlocal", "0", 0, "apply cl_cmdrate and rate to loopback connection" );
diff --git a/engine/common/net_ws.c b/engine/common/net_ws.c
index 2f98b8bb..d8206fef 100644
--- a/engine/common/net_ws.c
+++ b/engine/common/net_ws.c
@@ -1693,15 +1693,15 @@ void NET_Init( void )
 
 	if( net.initialized ) return;
 
-	net_clockwindow = Cvar_Get( "clockwindow", "0.5", FCVAR_LOCALONLY, "timewindow to execute client moves" );
+	net_clockwindow = Cvar_Get( "clockwindow", "0.5", FCVAR_PRIVILEGED, "timewindow to execute client moves" );
 	net_address = Cvar_Get( "net_address", "0", FCVAR_READ_ONLY, "contain local address of current client" );
 	net_ipname = Cvar_Get( "ip", "localhost", FCVAR_READ_ONLY, "network ip address" );
 	net_iphostport = Cvar_Get( "ip_hostport", "0", FCVAR_READ_ONLY, "network ip host port" );
 	net_hostport = Cvar_Get( "hostport", va( "%i", PORT_SERVER ), FCVAR_READ_ONLY, "network default host port" );
 	net_ipclientport = Cvar_Get( "ip_clientport", "0", FCVAR_READ_ONLY, "network ip client port" );
 	net_clientport = Cvar_Get( "clientport", va( "%i", PORT_CLIENT ), FCVAR_READ_ONLY, "network default client port" );
-	net_fakelag = Cvar_Get( "fakelag", "0", FCVAR_LOCALONLY, "lag all incoming network data (including loopback) by xxx ms." );
-	net_fakeloss = Cvar_Get( "fakeloss", "0", FCVAR_LOCALONLY, "act like we dropped the packet this % of the time." );
+	net_fakelag = Cvar_Get( "fakelag", "0", FCVAR_PRIVILEGED, "lag all incoming network data (including loopback) by xxx ms." );
+	net_fakeloss = Cvar_Get( "fakeloss", "0", FCVAR_PRIVILEGED, "act like we dropped the packet this % of the time." );
 
 	// prepare some network data
 	for( i = 0; i < NS_COUNT; i++ )