Just to be clear that allows connections from any origin. Any web page on a different domain could embed your app directly. My earlier suggestion was to have multiple instances of --allow-websocket-origin specified on the command line invocation which is perfectly possible to do.