Disable cross origin websockets by default.

This adds a function for testing if a request was done cross-origin, to protect against cross site websockets.

The opinionated piece of this PR is that cross origin is disabled by default. If a user wants to override it, they'll need to set `allow_cross_origin` to `True`.