Optionally override websockets authorization

I'm using OAuth2 bearer tokens in the Express middleware, so my API clients do not use cookies.

This breaks paradigm for Sails websockets, and because the current socket.io authorization function is non-configurable, I can't specify my own authorization function based on bearer tokens.

This baby diff just passes in a custom authorization function if it exists, otherwise it defaults to the standard session-based authorization.