WebSocket cross-site hijacking

WebSocket handshakes that rely only on cookies and skip origin checks can be opened from any site and driven with the victim's session.