Upgrader.Upgrade says:

// The responseHeader is included in the response to the client's upgrade
// request. Use the responseHeader to specify cookies (Set-Cookie) and the
// application negotiated subprotocol (Sec-WebSocket-Protocol).

But that's wrong. The Sec-WebSocket-Protocol header is filtered out from responseHeader and has to come from settting Upgrader.Subprotocols.