Fail WebSocket handshake for unauthorized token

Also changes the authentication JSON message for the simpler
`connected: ok` text message.