removing web app capability from non-webapp pages

for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

can be processed separately

to be more readable, add extra logging to process feed service

add permissive CORS to API controllers

to the API

registration API

Adding better errors for the API controllers, posting a simple status works from the frontend now