ok another update.~m~16~m~5890598851256073..~m~16~m~~j~{"buffer":[]}. doesn't belong in the handshake response. it's actually websocket framing.
the socket.io server will respond not only with the handshake response but immediately throw a session id back at nginx. since nginx doesn't know anything about websocket framing, it will think that it belongs to the challenge response and mess it up. any suggestions on how to switch from http to websocket framing?