Replaced one-pager with multiple pages and fixed security bugs

ws.go

@@ -10,7 +10,17 @@ import (
 )
 
 var upgrader = websocket.Upgrader{
-	CheckOrigin: func(r *http.Request) bool { return true },
+	CheckOrigin: func(r *http.Request) bool {
+		origin := r.Header.Get("Origin")
+		if origin == "" {
+			// Non-browser client without Origin header — allow.
+			return true
+		}
+		if originAllowed(origin) {
+			return true
+		}
+		return sameOriginRequest(r)
+	},
 }
 
 type wsMessage struct {