restrict connections to websocket only