Protect against cross origin websockets.

Since CORS headers don't exist in WebSockets land, we need to check origin and host. This adds origin and host checking within the WebSocketHandler.

The opinionated piece of this PR is that cross origin is disabled by default.

If a user wants different behavior, they'll need to override `check_origin`.