Add a couple more tests for websocket Origin handling
Add a couple more tests for websocket Origin handling

 * the default case: we block non-Host origins
 * garbage URL for Origin (hostile Origin header)

aiguofer/bokeh,draperjames/bokeh,aavanian/bokeh,azjps/bokeh,KasperPRasmussen/bokeh,ptitjano/bokeh,msarahan/bokeh,bokeh/bokeh,quasiben/bokeh,Karel-van-de-Plassche/bokeh,jakirkham/bokeh,aavanian/bokeh,stonebig/bokeh,mindriot101/bokeh,jakirkham/bokeh,draperjames/bokeh,schoolie/bokeh,mindriot101/bokeh,dennisobrien/bokeh,timsnyder/bokeh,azjps/bokeh,aavanian/bokeh,ericmjl/bokeh,justacec/bokeh,rs2/bokeh,mindriot101/bokeh,timsnyder/bokeh,rs2/bokeh,mindriot101/bokeh,KasperPRasmussen/bokeh,stonebig/bokeh,timsnyder/bokeh,percyfal/bokeh,phobson/bokeh,aiguofer/bokeh,schoolie/bokeh,bokeh/bokeh,justacec/bokeh,DuCorey/bokeh,ptitjano/bokeh,draperjames/bokeh,timsnyder/bokeh,bokeh/bokeh,philippjfr/bokeh,phobson/bokeh,clairetang6/bokeh,justacec/bokeh,aavanian/bokeh,azjps/bokeh,aavanian/bokeh,phobson/bokeh,philippjfr/bokeh,msarahan/bokeh,ericmjl/bokeh,bokeh/bokeh,DuCorey/bokeh,philippjfr/bokeh,ericmjl/bokeh,draperjames/bokeh,philippjfr/bokeh,justacec/bokeh,rs2/bokeh,aiguofer/bokeh,schoolie/bokeh,KasperPRasmussen/bokeh,ericmjl/bokeh,DuCorey/bokeh,msarahan/bokeh,azjps/bokeh,KasperPRasmussen/bokeh,ptitjano/bokeh,schoolie/bokeh,quasiben/bokeh,rs2/bokeh,Karel-van-de-Plassche/bokeh,dennisobrien/bokeh,DuCorey/bokeh,draperjames/bokeh,jakirkham/bokeh,percyfal/bokeh,azjps/bokeh,timsnyder/bokeh,dennisobrien/bokeh,ptitjano/bokeh,Karel-van-de-Plassche/bokeh,phobson/bokeh,percyfal/bokeh,Karel-van-de-Plassche/bokeh,rs2/bokeh,ptitjano/bokeh,KasperPRasmussen/bokeh,DuCorey/bokeh,msarahan/bokeh,jakirkham/bokeh,clairetang6/bokeh,dennisobrien/bokeh,clairetang6/bokeh,percyfal/bokeh,Karel-van-de-Plassche/bokeh,aiguofer/bokeh,aiguofer/bokeh,stonebig/bokeh,quasiben/bokeh,jakirkham/bokeh,stonebig/bokeh,phobson/bokeh,dennisobrien/bokeh,ericmjl/bokeh,percyfal/bokeh,schoolie/bokeh,clairetang6/bokeh,bokeh/bokeh,philippjfr/bokeh