Check cross site request token for WebSocket

http://www.christian-schneider.net/CrossSiteWebSocketHijacking.html
If the url sometimes needs to be calculated at runtime, I'd just always require the property to be  a function. It's way less ambiguous then. Also the documentation needs updating.