We fixed the XSS issue. Having said that, this site is just to demonstrate that you can use any standard web socket client (including the one in your browser); normally you would build the XSS mitigation into the client app if necessary.
What scenario do you have in mind for a "pub-sub pattern using WS"?
It might not be the scenario we were shooting for. The HTTP endpoint was an important requirement. We needed a way to receive HTTP POST calls in an app which wasn't accessible from the web (i.e. no incoming HTTP, but we could make an outbound WS call). Something like Runscope's Passageway (https://www.runscope.com/docs/passageway) would have been our first choice, but it wasn't easy to bake it into the app itself.
