Is it ever useful for an application to reject websockets that don't include an origin?  I think it might be better to pull this check up to `_execute`, and simply not call check_origin if no origin is given.