for local attachments, use them in URLs. Check status privacy
before redirecting to actual file.

Better initial state for unlisted/nsfw toggles

coming in via Salmon.

Currently no way to prevent remote follows, but they will only receive public
and unlisted posts

Reflect "requested" relationship in API and UI
Reflect inability of private posts to be reblogged in the UI
Disable Webfinger for locked accounts

Filters out hidden stream entries from Atom feed
Blocks now generate hidden stream entries, can be used to federate blocks
Private statuses cannot be reblogged (generates generic 422 error for now)
POST /api/v1/statuses now takes visibility=(public|unlisted|private) param instead of unlisted boolean
Statuses JSON now contains visibility=(public|unlisted|private) field

fix #361 with rich OEmbed display via iframe, fix #237 by hiding sensitive
content behind a spoiler on public pages

from accounts/tags because it's a terribly inefficient way to paginate
large sets of data

Fix #233, fix #268

by updating it at least every 24h if the user visits the site