Login with Express and use that to authenticate socket.io connections. This could probably be much better and is not production ready