better socket.io authorization handling