At line 262 in pzp_websocket.js, we have check that connection is accepted only from origin of websocket. After that message are handled. Are you suggesting to do this check for every message in wsMessage?