made the websocket connection NOT use cookies for auth, thus hopefully removing a glaring CORS security hole