Added an auth solution for websockets

Until we figure out how to intercept the HTTP get request that is upgraded into a websocket, we will be using a token-based system to indicate that a websocket can be trusted. Anyone can open a websocket with the server with this approach, but only authenticated users will be able to get a token allowing them to use it.
I'd spend some more time documenting what this all means.  What does "trusted" mean in our case?  You should talk about how we expect this to work with the session cookie, http auth, token, etc.  Spell it out.