letting port and environment parameters filter through to thin. also returning a 403 on non-websocket requests