Support token auth via query parameter

[rolweber]

As discussed in #211, token auth for web sockets requires the token to be passed as a query parameter rather than an Authorization header. This is independent of the token generation logic mentioned in #211, and compatible with the 1.x API.

[rolweber]

See PR #234 against the current master.
I'll wait with a PR against 1.2.x until the one for 2.0 has been reviewed.