remove on_first_message authentication

in ZMQStreams. No need for weird, special first message.

- use regular cookie auth
- use url param for session id