* fix(collab-net): never send the server key over plain ws:// to another machine
Publishing a plugin, uploading or sharing with the server's key accepted a
ws:// address for a remote host, so the reusable administrative key went
out in clear text. The key now goes only over wss://, or over ws:// to
this machine (loopback or localhost); browsing without a key is unchanged.
* address review: connect only to loopback addresses for a plain ws://localhost endpoint
Dylan M. Taylor
0f08269067