allow cross-origin websocket upgrades

this should obviously be more selective about what it allows, but will
work during development