Remove the Events controller which was unused
add a CSRF token to websocket stream URLs

This prevents other websites from opening our websocket.
Merge pull request #188 from typesafehub/wip/havocp-csrf-websocket

WebSocket CSRF protection