Fix auth bugs.
Add websocket auth.