Authorize a websocket subscription to the caller's own private-session-<gleapId> channel. Any other
channel name returns { "valid": false } with HTTP 200. Authenticated with the project's public API
key (api-token header) plus a signed session identity (gleap-id/gleap-hash headers).
Ok