examples/web-file-browser: Better error handling (filled in HTTP code TODOs; exception instead of error_log for fatal errors).
WebAuth: Don't assert() on bad CSRF token from session.

Let the app deal with it like any other CSRF mismatch.
examples/web-file-browser: Add comment about why it's an assert() and not something weaker.
examples/web-file-browser: Don't need to 'unset' (WebAuth.finish() does that for us).