Websockets (Socket.io) and authentication/authorization
===

I'm giving socket.io a whirl and I'm curious as to what I should and shouldn't be doing with websockets. 

For example is there a way to authenticate a websocket (include id in every message perhaps?)? Let's say I'm creating a 'google docs' like app in which people can create new documents. Should I be using AJAX to create new documents instead of websockets? That way I can use the standard HTTP transport layer to do all of the user authorization (checking session, etc) and then simply ping back the page with a websocket event. Curious as to how people handle situations like this.