WebSocket: Correctly expect masked frames from clients, and send masked frames from the client.

sdk/lib/io/http_session.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 const String _DART_SESSION_ID = "DARTSESSID";
 
 // A _HttpSession is a node in a double-linked list, with _next and _prev being
 // the previous and next pointers.
@@ skipping 54 matching lines @@
 // Private class used to manage all the active sessions. The sessions are stored
 // in two ways:
 //
 //  * In a map, mapping from ID to HttpSession.
 //  * In a linked list, used as a timeout queue.
 class _HttpSessionManager {
   _HttpSessionManager() : _sessions = {};
 
   String createSessionId() {
     const int _KEY_LENGTH = 16;  // 128 bits.
-    var data = _getRandomBytes(_KEY_LENGTH);
+    var data = _IOCrypto.getRandomBytes(_KEY_LENGTH);
     return CryptoUtils.bytesToHex(data);
   }
 
   _HttpSession getSession(String id) {
     return _sessions[id];
   }
 
   _HttpSession createSession() {
     var id = createSessionId();
     // TODO(ajohnsen): Consider adding a limit and throwing an exception.
@@ skipping 79 matching lines @@
       _timer.cancel();
       _timer = null;
     }
   }
 
   Map<String, _HttpSession> _sessions;
   int _sessionTimeout = 20 * 60;  // 20 mins.
   _HttpSession _head;
   _HttpSession _tail;
   Timer _timer;
-
-  external static Uint8List _getRandomBytes(int count);
 }