facebook/tornado — pull request #980 by rgbkrk (2014-01-24 05:35:44+00:00)
Title: Disable cross origin websockets by default.

This adds a function for testing if a request was done cross-origin, to protect against cross site websockets.

The opinionated piece of this PR is that cross origin is disabled by default. If a user wants to override it, they'll need to set `allow_cross_origin` to `True`.