Quota, DOS protection, or verification for the game relay server

It strikes me as a little dangerous to be running an open websocket relay server with no verification of its intended uses. Scenarios to think about:
1. Kid writes a cool game, shares on YouTube or something, it "goes viral", suddenly we have millions of connections.
2. Someone finds the protocol documentation, and decides to use it for their own unrelated shady commercial service, and suddenly we're handling millions of connections that aren't even about CodeWorld at all.
3. Someone thinks it's funny to take the system down, creates a session with 2000 players (because the work grows quadratically with the number of clients), and floods it with traffic from malware-infested systems.

It would be good to think about some of these issues. They are not pressing yet, but I'd rather they don't become pressing in the middle of the night!