Better initial state for unlisted/nsfw toggles

coming in via Salmon.

Currently no way to prevent remote follows, but they will only receive public
and unlisted posts

Reflect "requested" relationship in API and UI
Reflect inability of private posts to be reblogged in the UI
Disable Webfinger for locked accounts

Filters out hidden stream entries from Atom feed
Blocks now generate hidden stream entries, can be used to federate blocks
Private statuses cannot be reblogged (generates generic 422 error for now)
POST /api/v1/statuses now takes visibility=(public|unlisted|private) param instead of unlisted boolean
Statuses JSON now contains visibility=(public|unlisted|private) field

removing web app capability from non-webapp pages

since that is only ever called in the background

who don't follow them

(without avatar). Also improved search position of exact matches

Fix #233, fix #268

Fix #289 - don't download avatar unless the URL is http/https
Fix #293 - reblog/reblogged is now boost/boosted

skip ActionCable for follow/unfollow/block events, instead clear UI from
blocked account's posts instantly if block request succeeds. Add forgotten
i18n for sensitive content

during Fan Out On Write to load less stuff into memory