Add API to close an html activity

We are exposing it using a websocket server. The port of the server
is passed in the search string of the file:// url.
Require authentication before making API calls

Otherwise anything might access the bus.
Add a get_xo_color API