disable websocket same-origin protection

This only applies to tornado 4+, when same-origin checking was turned on by default.

I originally noticed this in the logs when looking into #120, but fixing it didn't fix my problem.