There are some people building on top of WebSockets with an eye towards security. Check out http://pusher.com/ for example, they designed system to account for 100% untrusted client.