client can spoof its username #10

The server trusts client's initial SYNC message to have the right username, which it shouldn't.

Better design would be for server to look at the signed session cookie of the incoming websocket connection, which should have been set up by the openid interaction. But SockJS doesn't give access to the cookies (https://github.com/sockjs/sockjs-node#various-issues-and-design-considerations).

Solutions:

• pass the signed session cookie with SYNC, instead of the username
• stop using SockJS and do our own lower-level websocket stuff, adapted from cswac. Would have the benefit that the cswac code already has automatic reconnection with backoff and retry, which SockJS doesn't have by default (see client websocket doesn't reconnect if server restarts #7).