In late 2017/early 2018 when their websocket was new I believe you had to be authenticated for either the initial order book query or the websocket subscription. Either way since we always locked our api keys to our IPs it wouldn't have mattered.