Password protection is there for a reason. If you have to police a person tgen there is no reason to play with them.

Until the devs add an option to character lock a server that is all you can do for now.

It is not bad design. It is as intended. Just doesn't work for YOU because your apparent friend doesn't care about the "rules" for the server.