it should be once per websocket, yes, that's where the challenge and the authed pubkey are stored

i had to do a lot of fixes to get that to work at all