Missing token in websocket/auth returns a 400