If I'm a random web page, and I open a websocket to the PZP and send a 'setExpectedPzh' message to my own domain name...

Can I then send any message to the PZP that I like, despite not being a valid application?