Added an auth solution for websockets

Until we figure out how to intercept the HTTP get request that is upgraded into a websocket, we will be using a token-based system to indicate that a websocket can be trusted. Anyone can open a websocket with the server with this approach, but only authenticated users will be able to get a token allowing them to use it.
This `typeof` check is odd.  What about doing `data = data.data || data` instead (i.e., just grab the `data` property if there, otherwise use the whole thing)?