We broke WHIP when we introduced splitPath.  Thanks to Tim Panton.

We were already ignoring files starting with colon.

Keep a redirect for backwards compatibility.

Use it for parsing special paths instead of ad hoc code.

If the WHIP session is not authenticated, then the only thing
preventing an attacker from DELETEing the session is the session
URL.  Since client ids are known, obfuscate the id before using
it in the session URL.

A token with no "sub" field is now treated just like one with an
empty "sub".  In addition, all times are treated with a slack of 5s.

Also use Duration.Abs.

We used to have unbounded channels embedded within rtpconn
and webClient.  Make the structure explicit and testable.

This may happen if we're running over plain HTTP.
Thanks to kovmir.

gorilla/websocket is not updated, since 1.5.1 doesn't look good
to me.

We used to accept the browser's default, which varied widely
between devices.

This reverts commit 69445d67.

The onclose callback might want to access c.sc.

Replaced the non-existent `track` property in `RTCStatsType`
with the valid `inbound-rtp` property.