[webapi] Improve exception message for zap security

- Use "error" instead of exception message
Merge it as-is.

Before submitting to W3C, we need to refine this.