Re-implemented CORS.
Minor cleanup.
We need to make a clean close or upgrade failed to tell clients that
they are not allowed to access the websocket with their current
(possibly missing) token.
So. For now we have a nice TODO :-|
Apparently not all channels spawn CHANNEL_CREATE and CHANNEL_DESTROY
events and thus, channels that are created when entering our
pre-queue are not removed by the global CHANNEL_DESTROY observer.
By reaping them upon a state change to hungup, we can make sure
that no inactive calls are haunting our call list.