* Add guard against DNS rebinding attacks

* Fix not to apply to test environment

* Set CSP rules in RoR's configuration

* Override CSP setting in the embed controller to allow frames

* enforce https in production

* note changes in production env sample

* typo fix

* Change streaming API URL when remote development

* Use STREAMING_API_BASE_URL when dev env

connection options instead of setting REDIS_HOST etc individually

Close #1986

* Allow running mastodon on a different domain as the one used for identifying users

* Alter documentation of WEB_DOMAIN to make clear it shouldn't be used unless the admin knows what they are doing

* Compare to web_domain instead of local_domain when dealing with feeds/API

* Correctly identify mentions to local accounts

Mentions URLs point to the person's web profile, i.e., the user page served on WEB_DOMAIN.

work flawlessly was a nightmare). WARNING: This commit makes the web UI connect to the streaming API instead
of ActionCable like before. This means that if you are upgrading, you should set that up beforehand.

removing web app capability from non-webapp pages

to be more readable, add extra logging to process feed service