fix #361 with rich OEmbed display via iframe, fix #237 by hiding sensitive
content behind a spoiler on public pages

removing web app capability from non-webapp pages

Closes: #345

Closes: #337

Do not autoplay videos, display play button instead. Use expiring links when using S3. Do not keep originals
for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

Closes: #334

from accounts/tags because it's a terribly inefficient way to paginate
large sets of data

Fix #233, fix #268

can be processed separately