[webui] Use an esoteric statuscode to be sure protect_from_forgery hits in CSRFTest