for local attachments, use them in URLs. Check status privacy
before redirecting to actual file.

for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

to the API

Using `-strip` cli options from ImageMagick

http://www.imagemagick.org/script/command-line-options.php#strip

fix #85

timeline reload in UI, other small fixes