added testing for sockets, implemented auth on sockets

Went through the painstaking process of implementing auth on socket.io
sockets (not too bad), then figured out how to test them (the hard
part). The final solution injects a little bit of custom logic into
xmlhttprequest to append the cookie. Long story short, now sockets are
authorized-access only, and are unit-tested to verify this.