Provide JWT tokens to Websocket without passing via HTTP headers

[thjaeckle]

For the WebSocket browser API it is not possible to pass a JWT token as Authorization HTTP header as this API does not allow to set custom headers.

So there is no straight-forward way to connect to a Ditto websocket from the browser.

We should enable that by either

• allowing to open an unauthenticated WS session and passing as first message the JWT token via the WS
• or by using the sub-protocol field of the WS (for which there is an API in the browser) in order to transport the JWT token

I would prefer the first one as we already do the JWT token refresh also via a WS message.

[ameinhardt]

Browser are able to pass cookies before the upgrade handshake, so the JWT could be passed there, also. That is straight-forward, as long as the browser has gotten a suitable cookie from the ditto domain