Change JWT header field

The JavaScript WebSocket API in browsers does not allow for adding
custom headers.
Instead, we repurpose the protocol header "sec-websocket-protocol"
to carry our JWT auth token.