For WebSocket authentication checks, does Nightcrawler currently support token-based (e.g., JWT in query params or headers) patterns, or is it limited to session cookies?