I have the websocket server as a gen_server process which could be tied into an existing supervisor. Each connected client is an Erlang process a non gen-server one primarily because restarting a failed client is almost useless since the n/w connection cannot be reconnected. For flood prevention i use a simple concurrent connection counter and limit the max concurrent connections.
Nice this started out as a fun implementation and now does transparent SSL and flash policy responses. Uses port forwarding to server on different ports.