For now, we should just disable setExpectedPzh when the PZP is already enrolled.

For the future, we need to have a whitelist of allowed origins that the WebSocket will accept connections from.