Add API to close an html activity

We are exposing it using a websocket server. The port of the server
is passed in the search string of the file:// url.
Require authentication before making API calls

Otherwise anything might access the bus.

Note: This will not work if the user moves to another html page.  They
will not have a port/key passed in the query string of the URL, so
they won't be able to connect.
Add a get_xo_color API