SignalR connection tokens are not bound to the endpoint that negotiated them

[cincuranet]

SignalR stores negotiated connections in an application-wide HttpConnectionManager keyed only by connection token, so an authorized client can negotiate on one endpoint with CloseOnAuthenticationExpiration=false and use that token to connect to another endpoint where it is true. The target endpoint’s authorization and hub still apply, but the connection retains the first endpoint’s options and is not closed when authentication expires. We should bind connections to their originating endpoint mapping and reject tokens presented to a different endpoint.