shared/ws: Remove CheckOrigin bypass

We've apparently always turned off this particular safety check but
can't find a good reason for that as all complex Websocket operations
are done outside of the browser.

For browser-based interactions, the default behavior of enforcing an
Origin match seems quite appropriate.

Reported-by: https://7asecurity.com
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

shared/ws/upgrader.go

@@ -1,7 +1,6 @@
 package ws
 
 import (
-	"net/http"
 	"time"
 
 	"github.com/gorilla/websocket"
@@ -9,6 +8,5 @@ import (
 
 // Upgrader is a websocket upgrader which ignores the request Origin.
 var Upgrader = websocket.Upgrader{
-	CheckOrigin:      func(_ *http.Request) bool { return true },
 	HandshakeTimeout: time.Second * 5,
 }