Might be good to have a relatively small timeout on session authentication (e.g., 5 seconds). If a socket is opened and not authenticated within 5 seconds, we'll close it.

We'll have an idle timeout on Nginx (e.g., a minute), but one minute is a fairly large interval in which to allow an unauthenticated attacker to open hanging websocket connections.