fix auth checks. require token for socket.io events.