libtorc-core: Refactor WebSocket authentication.

- standard WebSockets created from a browser do not send authentication
headers so we need to append a query string to the url.
- if authentication is enabled, a remote websocket user should first
request a token from /services/GetWebSocketToken via the standard HTTP
interface (using authentication).
- the return token is then valid once within ten seconds and should be
appended to the WebSocket url (e.g. ws://host:port?

This ensures authentication is consistent between standard HTTP requests
and websockets and a web interface user need only authenticate once for
both routes.
html: Use new token authentication in torcwebsocket.js

- we always request a token, even if authentication is not enabled (it
doesn't hurt).
libtorc-core: Disable HTTP authentication by default.

- accidentally enabled in previous commit.
libtorc-core: Remove per path HTTP protection

- not actually needed so revert to complete protection when enabled.
libtorc-core: Remove TorcHTTPRequest::SetQuery

- wasn't needed afterall and was non-sensical.
libtorc-core: Improved WebSocket authentication by checking host.