Unit tests for ; and fix !! and !$ tests
Protect control stream against CSRF

Rely on HTTP rules for CSRF: allow access to the websocket resources IFF
client has access to the HTTP resources