chat.yakka.getRealtimeTicket

Issue a short-lived, single-use ticket for opening the realtime socket (ADR 0034 §3). A browser cannot set headers on a WebSocket, and a cookie is the wrong instrument across origins — so the ticket goes in the socket URL, which is why it must be worth little: it authenticates one upgrade, once, within seconds. The socket is the appview's primary surface (ADR 0011), so this is not an afterthought but the only authenticated path for most of what a client does.