[feature] Feature Request: Support HttpOnly Cookie Authentication for SSE `/connection/*` Endpoint

Currently, establishing an SSE connection to Centrifugo via /connection/* requires passing a token (e.g. JWT) in query parameters.

In browser-based apps, this means tokens must be accessible in frontend JavaScript, increasing exposure to leakage via:

• XSS
• browser history
• logs / monitoring tools

---

Proposed Feature

Support authentication using HttpOnly cookies for SSE /connection/* requests.

---

Motivation

EventSource does not support custom headers, making query params the default for auth. However, cookies:

• are sent automatically by the browser (for the same domain)
• can be HttpOnly (not accessible to JS)

Supporting cookie-based auth would:

• eliminate the need for query tokens
• reduce XSS exposure
• align with standard session-based auth patterns

---

Expected Behavior

For both unidirectional and bidirectional SSE:

1. Cookies are included in /connection/* requests
2. They are available in authentication hooks (proxy / connect)
3. Backend can authenticate users based on cookies

---

Current Behavior

• SSE auth relies on explicit token passing (e.g. query params)
• Cookie-based auth is not clearly supported or documented for /connection/*

---

Additional Context

This would bring SSE authentication closer to:

• traditional HTTP session auth
• WebSocket setups using cookies