Ideally you simulate on the client side too and use the server as an authenticity check. This way, if the connection is briefly lost, you don't have to immediately stop the game (especially if, for example, you're in an area all by yourself at that point).
DH, your code is pretty lengthy for me to look over but you have at least two options:
Display the packets being received on the server from your client. Make sure that after the client player spawns, the serrver is receiving player data from the client and you're reacting accordingly (updating x,y, etc.).
You can take Ken's advice and have server authorize client's player before they each create it.