remove on_first_message authentication

in ZMQStreams.

- use regular cookie auth
- use url param for session id

No need for weird, special first message.

I know cookies didn't used to work in websockets in Tornado. This may have been a limitation of tornado < 3.