Push Notifications follow-up

 * Using `replyTo` for replies to earlier client messages
 * Cleaned and added a bunch of unit tests
 * Added a maximum timeout of 5 seconds. If the client hasn't authenticated by then, their socket will be dropped