accept cross-origin websocket connections by default

fixes #63. Tornado 4 introduced 403 status code in case of cross-origin websocket connections. Here `websocket_allow_origin` SockJS server option was introduced. By default its value is "*" - i.e. accept all websocket connections. But it can also be a list of allowed origins