set: Print an error when setting `umask` to a bad value

Repurpose the ENV_INVALID return value for env_set(), which wasn't
currently used by anything. When a bad value is passed for the 'umask'
key, return ENV_INVALID to signal this and print a good error message
from the `set` builtin.

This makes `set umask foo` properly produce an error.
doc: Fix links in "Further help and development"

Hyperlink the mailing list to the proper info page.

Tweak the GitHub link to use https.
doc: Fix docs on $HOME/$USER

The docs claimed that the $HOME and $USER variables could only be
changed by the root user. This is untrue. They can be changed by
non-root users as well.
doc: Document how IFS affects command substitution

IFS is used for more than just the read builtin. Setting it to the empty
string also disables line-splitting in command substitution, and it's
done this for the past 7 years. Some day we may have a better way to do
this, but for now, document the current solution.
Clean up the IFS handling in command substitution

Remove the useless ASCII test of the first byte of IFS. We don't split
on the first character, we only use a non-empty IFS as a signal to split
on newlines.
webconfig: Use a constant-time token comparison

This prevents a linear-time attack to recover the auth token.
webconfig: fixes for token security

 * Use 16-byte tokens
 * Use os.urandom (random.getrandbits shouldn't be used for security)
 * Convert to hex correctly