diff --git a/jsgi/csrf.js b/jsgi/csrf.js
index 3b0ba92..b2c0770 100644
--- a/jsgi/csrf.js
+++ b/jsgi/csrf.js
@@ -12,6 +12,7 @@ var CSRFDetect = function(customHeader, nextApp){
 		var headers = request.headers;
 		if(!(headers[customHeader] || /application\/j/.test(headers.accept) ||
 			(request.method == "POST" && headers.referer && headers.referer.indexOf(headers.host + '/') > 0) ||
+			(headers.stream && headers.origin && headers.origin.indexOf(headers.host) > 0) ||
 			(request.method != "GET" && request.method != "POST"))){
 			request.crossSiteForgeable = true;
 		}
diff --git a/package.json b/package.json
index 72259c0..a673bfa 100644
--- a/package.json
+++ b/package.json
@@ -4,15 +4,17 @@
   "author": "Kris Zyp",
   "email": "kriszyp@gmail.com",
   "description": "JSGI-based RESTful JSON/JavaScript server",
-  "contributors": ["Vladimir Dronnikov <dronnikov@gmail.com>"],
+  "contributors": [
+    "Vladimir Dronnikov <dronnikov@gmail.com>"
+  ],
   "keywords": [
     "rest",
     "database",
     "web",
     "json",
     "persevere"
-  ],  
-  "mappings":{
+  ],
+  "mappings": {
     "perstore": "http://github.com/kriszyp/perstore/zipball/v0.2.4",
     "templify": "http://github.com/dmachi/templify/zipball/master",
     "promised-io": "jar:http://github.com/kriszyp/promised-io/zipball/v0.2.3!/",
@@ -35,37 +37,37 @@
     }
   },
   "licenses": [
-     {
-         "type": "AFLv2.1",
-         "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L43"
-     },
-     {
-         "type": "BSD",
-         "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L13"
-     }
+    {
+      "type": "AFLv2.1",
+      "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L43"
+    },
+    {
+      "type": "BSD",
+      "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L13"
+    }
   ],
   "repository": {
-    "type":"git",
-    "url":"http://github.com/persvr/pintura"
+    "type": "git",
+    "url": "http://github.com/persvr/pintura"
   },
   "directories": {
     "lib": "."
   },
   "maintainers": [
-  	{
-  		"name": "Kris Zyp",
-  		"email": "kriszyp@gmail.com"
-  	}
+    {
+      "name": "Kris Zyp",
+      "email": "kriszyp@gmail.com"
+    }
   ],
-  "dependencies":{
-    "tunguska": ">=0.3.0",
-    "rql": ">=0.3.1",
-    "websocket-server": ">=1.4.01",
+  "dependencies": {
+    "formidable": ">=1.0.0",
+    "jsgi-node": ">=0.2.5",
     "perstore": ">=0.3.0",
     "promised-io": ">=0.3.0",
-    "formidable": ">=1.0.0",
+    "rql": ">=0.3.1",
     "templify": ">=0.9.0",
-    "jsgi-node": ">=0.2.5"
+    "tunguska": ">=0.3.0",
+    "ws": "^0.4.32"
   },
   "devDependencies": {
     "patr": ">=0.2.6"
diff --git a/start-node.js b/start-node.js
index d82b556..879907e 100644
--- a/start-node.js
+++ b/start-node.js
@@ -1,6 +1,6 @@
 // helpful for debugging
 var settings = require("perstore/util/settings"),
-	ws = require("websocket-server"),
+	ws = require("ws"),
 	messageJson = require("./media/message/json");
 
 exports.start = function(jsgiApp){
@@ -9,9 +9,7 @@ exports.start = function(jsgiApp){
 		);
 	var port = settings.port || process.env.PORT || 80;
 	server.listen(port);
-	require("jsgi-node/ws-jsgi")(ws.createServer({
-		server: server
-	}), function(request){
+	require("jsgi-node/ws-jsgi")(ws.createServer({ server: server }), function(request){
 		request.method = "POST";
 		var headers = request.headers;
 		headers.accept = "message/json";
@@ -19,7 +17,7 @@ exports.start = function(jsgiApp){
 		headers.stream = true;
 		return jsgiApp(request);
 	});
-	
+
 	console.log("Listening on port " + port);
 	return server;
 };