Better initial state for unlisted/nsfw toggles

coming in via Salmon.

Currently no way to prevent remote follows, but they will only receive public
and unlisted posts

Reflect "requested" relationship in API and UI
Reflect inability of private posts to be reblogged in the UI
Disable Webfinger for locked accounts

fix #361 with rich OEmbed display via iframe, fix #237 by hiding sensitive
content behind a spoiler on public pages

removing web app capability from non-webapp pages

Closes: #345

Closes: #337

for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

Closes: #334

from accounts/tags because it's a terribly inefficient way to paginate
large sets of data

Fix #233, fix #268

can be processed separately