Webserver: Alternate WebSocket credentials

Username and password can now be specified for each websocket
connection and are not limited to the credentials used when logging
into Cockpit.

* They are passed in as the first message on the websocket since there
  doesn't seem to be a way to pass them in the headers and including
  them in the URL is not acceptable.

* Opening the session is delayed until that first message is received.