A couple of places were using "reblog" rather than "boost" - this updates them to match the web UI

Better initial state for unlisted/nsfw toggles

coming in via Salmon.

Currently no way to prevent remote follows, but they will only receive public
and unlisted posts

Reflect "requested" relationship in API and UI
Reflect inability of private posts to be reblogged in the UI
Disable Webfinger for locked accounts

fix #361 with rich OEmbed display via iframe, fix #237 by hiding sensitive
content behind a spoiler on public pages

removing web app capability from non-webapp pages

Closes: #345

Closes: #337

Do not autoplay videos, display play button instead. Use expiring links when using S3. Do not keep originals
for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

Closes: #334