security: validate WebSocket origins to prevent drive-by attacks