remove on_first_message authentication

in ZMQStreams. No need for weird, special first message.

- use regular cookie auth
- use url param for session id
Merge pull request #6629 from minrk/wscookie

remove on_first_message authentication