Easy to trigger invalid session

## Problem

It's easy to trigger the "Direct Access disallowed" in the web apps
for example, user quit and reopen the mobile browser.
They will see a cryptic message

> ## Direct access to this page is disallowed
>
> This page can only be accessed via the authorization endpoint.

## Proposed change

1. Change the message to a more user-friendly one
1. To be handled in [DEV-350 : Improve error page for CSRF Error page​](https://linear.app/authgear/issue/DEV-350/improve-error-page-for-csrf-error-page)
2. Switch to a Max-Age cookie of 5 minutes. Each request will extend the age by 5 minutes.

Please also research if giving up session cookie is ok security-wise

No file or test is named. Start by tracing the web-app session-cookie handling and the “Direct access to this page is disallowed” path, then review the linked DEV-350 issue and investigate the security implications of the proposed cookie change. Done means the invalid-session experience is user-friendly, the cookie behavior is implemented as agreed, and the security research is documented.

Written by the indexing model from the issue text.