respect basic auth in events stream callback

websocket urls don't technically support basic auth, so parse it out and
manually forward the Authorization header.