added path authentication and bug fixes realted to passing events onto underlying session if main websocket session is not authenticated