Function origin_allowed 

pub fn origin_allowed(headers: &HeaderMap, ws: &RouteWebsocket) -> bool

The origin gate: true when the handshake may proceed. A non-empty allowlist admits only exact matches; a missing Origin is denied under a non-empty allowlist (fail closed).