Apps need your explicit permission to access your smartphone’s motion and light sensors. Mobile websites? Not so much.