removing web app capability from non-webapp pages

Closes: #345

Closes: #337

for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

Closes: #334

from accounts/tags because it's a terribly inefficient way to paginate
large sets of data

Fix #233, fix #268

can be processed separately

e