* sec: do not expose traffic stats to all users, harden origin check in websocket endpoint * add tests to validate new logic