Allow `onAuthenticate` to be passed from extension

Currently the server checks for the existence of `onAuthenticate` only on it's own config passed into the constructor, this stops you from creating a modular extension to handle authentication, which would be nice. In fact, if you try this the server crashes when it receives the auth token from the client 🙈 

sidenote: Some more graceful handling of unknown messages might be nice.