Minor fix
Fix authenticate() behaviour
Unmask websocket data in the channel buffer rather than the user buffer
Mask at header creation time

This is much more efficent, as it can be done using the frame
buffer rather than copying a users buffer
Generate a new masking key for each frame
Fix masking issue