Socket.IO security & HTTP Cookies for authentication

https://github.com/LearnBoost/Socket.IO/wiki/Configuring-Socket.IO

```
Security Note: If your socket.io server uses HTTP Cookies for authentication,
the origins option should be restricted to only trusted hosts. Leaving the default
value can lead to third party sites performing authenticated cross-domain
requests to your socket.io endpoints and accessing unauthorized application data
```
