Check cross site request token for WebSocket

http://www.christian-schneider.net/CrossSiteWebSocketHijacking.html
I'm always wary when tests use external variables like this in checks, I've seen situations where you get false positives because some external change causes the variable to be `undefined`.

To make this test clearer I think it would be better to return a string here eg. `'http://example.com'` then explicitly check for that string in the test.