This fixes #2375.

Remove protect_from_forgery in ApiController, which is disabled by the
following skip_before_action, as well.

* Add status destroy authorization to policy

* Create explicit unreblog status authorization

* Add StreamEntryFinder class to parse URLs

* Use StreamEntryFinder and clean up api/oembed controller

* Remove methods from ObfuscateFilename

* Spec ObfuscateFilename

* Set delete_modal preference to true by default
* Does not show confirmation modal if delete_modal is false
* Add ja translation for preference setting page

recent is included in paginate_by_max_id.

In single user mode, visitors are redirected to the single user's
profile page.  So, if you are the owner without a session, you start
from that page, click the login button and authenticate yourself
expecting you'll soon get started with the home page, but in reality
you'll get redirected back to where you started from -- your own
profile page.

This fixes the behavior by redirecting you home after login if you
have started from your own profile page.

This will reduce requests on who have only few statuses.

- Use next link header to detect more items from first request
- Omit next link header if result items are fewer than requested count
(It had omit it only if result was empty before)

Link headers in following/followers API should include follow_id as max_id/since_id.

However, these API use current_user's account_id instead of follow_id from #3167.
This causes irrelevant result on loading more users.

(You may think that we need account deletions, but this way would've just orphaned the db records)

- Increase coverage to exercise all parts of each action
- Move into namespace to share common code
- Misc refactor of each action for smaller methods, simpler code

* Cover StreamEntriesController more

* Remove redundant instructions in StreamEntriesController

Introduce recent to Follow, as Account and other models have.
This change also adds specs for the scope and the dependents.

* Introduce recent scope to Status and StreamEntry

Introduce recent scope to Status and StreamEntry as Account has.

* Cover AccountsController more in AccountsController

This change also adds a specification for the method.

This commit fixes a regression in commit
f554807563.

The regressions are introduced at commit
f554807563 by me (Akihiko Odaki)

* Remove allowed_languages and add filtered_languages

* Use filtered_languages instead of allowed_languages

* Add buttons to block and unblock domain

* Relationship API now returns "domain_blocking" status for accounts,
rename "block entire domain" to "hide entire domain", fix unblocking domain,
do not block notifications from domain-blocked-but-followed people, do
not send Salmons to domain blocked users

* Add test

* Personal domain blocks shouldn't affect Salmon after all, since in this
direction of communication the control is very thin when it comes to
public stuff. Best stay consistent and not affect federation in this way

* Ignore followers and follow request from domain blocked folks,
ensure account domain blocks are not created for empty domain,
and avoid duplicates in validation

* Purge followers when blocking domain (without soft-blocks, since they
are useless here)

* Add tests, fix local timeline being empty when having any domain blocks