Function handshake_check

fn handshake_check(
    allowed_origins: &[String],
    req: &Request,
    response: Response,
) -> Result<Response, ErrorResponse>

Vets one WebSocket handshake: the owp subprotocol, then the Origin.

Missing or unmatched Sec-WebSocket-Protocol is 400. When allowed_origins is non-empty, an Origin header that is not one of its entries verbatim (a missing Origin included) is 403; an empty allowed_origins skips the check and accepts any origin. On success the response echoes owp.