Re-reading this again, the idea is that an attacker would be doing a MITM attack between the client and the actual web server?

What prevents them from bypassing this entirely by just not adding the Origin and Host headers?

Clearly websockets should be done over HTTPS and that additional auth on websockets should be required.