common: Make cockpit test logic thread safe

In particular the expected messages stuff should be thread-safe

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
websocket: Clarify a couple TODO's that are really HACK's

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
websocket: Validate the Host and Origin headers properly

This prevents CSRF attacks.

Fixes #496
Closes #535
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Signed-off-by: Marius Vollmer <marius.vollmer@redhat.com>
* Adapted one test to changes in master, where a warning is now a
  message.
ws: Make the core cockpitwebsocket code a real object

This will allow us to do things like have it be reference counted
and so on.

Call it CockpitWebService since it's really the core of the
web service.

Closes #542