Avoid websocket proxies needing to have matching have config '*_baseurl' configs with compute nodes

[Nikola Đipanov]

As part of the fix for the related bug - we've added protocol checking
to mitigate MITM attacks, however we base protocol checking on a config
option that is normally only intended for compute hosts.

This is quite user hostile, as it is now important that all nodes
running compute and proxy services have this option in sync.

We can do better than that - we can persist the URL the client is
expected to use, and once we get it back on token validation, we can
make sure that the request is using the intended protocol, mitigating
the MITM injected script attacks.

[John Garbutt (johngarbutt)]

https://review.openstack.org/#/c/169753

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/169753
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=9621ccaf05900009d67cdadeb1aac27368114a61
Submitter: Jenkins
Branch: master

commit 9621ccaf05900009d67cdadeb1aac27368114a61
Author: Nikola Dipanov <email address hidden>
Date: Wed Apr 1 14:42:00 2015 +0100

    websocketproxy: Make protocol validation use connection_info

    With this change, we avoid the need to have config '*_baseurl' config
    options correctly set up on nodes running console-proxy services, as the
    access_url is now available after token validation.

    UpgradeImpact: Websocket proxies need to be upgraded in a lockstep
    with the API nodes up to this commit (or when upgrading to Kilo),
    as older API nodes will not be sending the access_url when authorizing
    console access, and newer proxy services (this commit and onward) would
    fail to authorize such requests.

    Change-Id: I721bca407bf9d3fb33a3461c04d392284448d4a6
    Closes-bug: #1442048