Review potential cross-site security issue wrt Websocket

Issue by jrudolph Thursday Sep 24, 2015 at 09:05 GMT Originally opened as https://github.com/akka/akka/issues/18549

---

@fommil reminded me that browsers may not be strict enough in preventing cross-site scripting to prevent malicious sites from opening up websocket connections on the behalf of the browser user.

We need to check in which situations this can lead to problems and how to prevent insecure access (e.g. by changing the server-side Websocket API to force the developer to provide an Origin checker to accept incoming Websocket requests).