This makes the CORS policy for websocket clients more strict by ensuring
any requests from other domains are rejected. It is worth noting that,
in practice, the current less strict mechanism is secure due to both the
use of a self-signed TLS certificate and the requirement for
authentication to issue any commands, but further hardening is still
desirable.
e917dcb795