add /WebWidget.js as alternative to /WebWidget for easy inclusion without reverse proxy

usage in a container: <script src="xxxx/WebWidget.js"></script>

uses great & easy pattern "HTML client-side include":

echo "document.write(" . json_encode(file_get_contents($html_file)) . ");";
js: instead of using a global var "xhrRequestInvalidCsrfState", use a parameter flag

not sure it's better to handle 2 parrallel CSRF errors,
but the code is cleaner that way for next commit
if cookies are rejected, try passing sessionId in url (as expected by java servlets)
js: specific error message in case of WS error 503
for server side templates, use {{serverSide.xxx}} instead of simply {{xxx}}

this will allow more powerful things and is clearer regarding angularjs
implement service-side-xxx directives to handle wsgroupsURL css/js + cache busting (aka fingerprinting)

NB: the cacheBuster adds ?v=<timestamp> to urls, which is not best according to https://developers.google.com/speed/docs/best-practices/caching
    but it should be quite good for our needs (and better than nothing!!)
implement service-side-concat & service-side-angular-templates directives

it allows concat of js files + angularjs templates