allow WebSocket clients operate without URL
allow WebSocket servers operate without URL
fix host header checking; tighten parseWsUrl