WebSocket CSRF protection

Merge https://github.com/typesafehub/activator/pull/186 first to remove it from this diff.