Server uploads script to clients, clients md5 it and send the hash back. Server maintains game state for all clients and does not trust clients - if server says client dies, and client then says "no, I shoot dave", server says "no, you're dead" (you'd have to allow for lag, but just ping the client every once in a while to measure lag).