refactored cookie verification into separate method

we now pass the cookie through the websocket to authenticate
the websocket client
overhauled realtime change notification