Have you restricted websocket access? That nginx hack thing you did maybe?