Move task #248 (accept the API token as the first WS frame instead of a
?api_token query param, which leaks into access logs) into the websocket
docs as a Future work section with rationale, protocol sketch, and scope.