use client-generated uuid rather than faye clientID, which is insecure