fix(security): first-message WebSocket auth to prevent token leakage

fix(security): first-message WebSocket auth to prevent token leakage #10955