websocket: Validate the Host and Origin headers properly

This prevents CSRF attacks.

Fixes #496
Closes #535