The beautiful solution would be to add AUTH support and then accept these events after the client automatically authenticates.

I'm not sure how you would do that, I think instead of forwarding the websocket messages to strfry you could just call "strfry import" and it would accept anything.