add websocket support

Fixes #33 

Initial draft. There's still likely many problems with this proposal. I attempted to consolidate the spec by intermizing websuc vs websockets. Alternatively, we could split the two approaches.

Additionally, does the re-use of `cast-session` make sense as a "ticket" type authn mechanism make sense? Is it good security?

Author: isaacvetter