Security: HTTP publish endpoint and WebSocket app key are completely unauthenticated

[stephenjason89]

Problem

Two authentication gaps undermine the channel auth model:

1. The HTTP publish endpoint verifies nothing. Pusher's REST API requires a signed request (auth_key, auth_timestamp, auth_version, body_md5, auth_signature — HMAC SHA256 of the request over the app secret). handleEventPublishing accepts any POST from anyone who can reach the port and broadcasts to any channel, including private- and presence- channels. Private channel subscription auth is pointless while this is open.

2. The app key in the WebSocket connection path is never validated. pusher-js connects to /app/{key}, but handleWebSocketUpgrade upgrades any path with any key.

What's needed

• Verify the Pusher REST auth signature on POST /apps/{app_id}/events (see Pusher HTTP API auth spec) and reject with 401 on mismatch
• Validate app_id in the path and the {key} segment on WebSocket upgrade against PUSHER_APP_ID / PUSHER_APP_KEY, rejecting unknown keys with the protocol error (4001)

Related: #5 covers the payload/route compatibility of the same endpoint.