Authenticating WebSocket connections at the edge

Where authentication belongs in a WebSocket handshake, why Origin is not authentication, and which checks to run.