Add access control headers to login response.
Configured modules don't need to know about the token secret.
Better way to get query data from socket handshake.