Oooh boy you touched a pet peeve. I mean who needs authentication on the modern Web right? /s

The even more irritating thing is that there is nothing preventing this, and every server I've tried supports it. It's only the browser WebSocket API that was designed without this. Cookies are the only thing browsers will deign to send in the initial request.