Isn’t it a proof that liveview web socket is calling your plug? Otherwis, it wouldn’t be broken. Maybe the parameters you injected interfere with liveview connection, so it think the connection attempt is from a unauthorized party, ie. cross-site attack.
What did you do in your plug?
