Currently, the http connection manager immediately surrenders websocket requests to the websocket handler, bypassing all http_filters. This is problematic for API front proxies which need to terminate client TLS and pass authentication info in headers to upstream API servers. An Http::StreamDecoderFilter implementing such a proxy will not be called in the websocket handling code path, effectively disallowing TLS client auth on requests requiring websockets.

cc @rshriram @mattklein123