- change seqno only on authenticated request,
so that bad guys make a bunch of bad calls and lock out actual calls
- Fix %ld format for long
(seqnos are long in case GUI makes > 2B calls)
- Print message if validation fails
- end of HTTP header is marked by \r\n\r\n, not \n\n
Also put some error checking into the client-side Javascript.
E.g. things should still work if password file is absent;
you just can't make RPCs that require authentication.
Much work still to be done here.