feature(package) socket.io: lock down