For a user to successfully open a connection to a mod's worker, he needs to create a WebSocketSession with an identity object provided. That identity therefore has to be acquired and validated first.
That identity and its associated token is expected to be associated with the WebSocketSession for as long as the WebSocket stays open.
However, it is possible for applications that use data from different companies that multiple identities may be needed. Those identities should be added to the WebSocketSession as they become known, and persisted in the database, as well as being passed as properties on DataOperations, which currently has only one "identity" property.
Passing an array of fully serialized identity/tokens for each operation might get a bit heavy, but would spare round-trips to the DB to get the details if needed. Which would also depend on how frequently those are needed for data operations within the worker