websocket: add support for checking Origin headers.