common: Make cockpit test logic thread safe

In particular the expected messages stuff should be thread-safe

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
websocket: Clarify a couple TODO's that are really HACK's

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
websocket: Validate the Host and Origin headers properly

This prevents CSRF attacks.

Fixes #496
Closes #535
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Signed-off-by: Marius Vollmer <marius.vollmer@redhat.com>
* Adapted one test to changes in master, where a warning is now a
  message.