* With the new JWT signatures on photo URLs, it was no longer possible for
creative users to embed their gallery photos on their profile page.
* Add a function to ReSignPhotoLinks that finds/replaces (on the server side)
all references to paths under "/static/photos/" and gives them a fresh
?jwt= query string signature.
* Note: only applies to the profile page essays, ReSignPhotoLinks is a
template func that must be opted-in on a per page basis.
Other miscellaneous fixes
* Add "Edit" buttons in the corners of profile cards, when the current user
looks at their profile page. They link to URIs like
"/settings#profile/about_me" which will now:
1. Select the "Profile settings" tab like #profile
2. Scroll and focus the profile essay field that the user clicked to edit.
* The photo signing JWT tokens carry more fields to validate against:
* The username the token is assigned to (or '@' for anyone)
* An 'anyone' boolean for widely public images, such as for the chat room
and public profile pages.
* A short filename hash of the image in question (whether a Photo or a
CommentPhoto) - so that the user can't borrow a JWT token from the chat
room and reveal a different picture.
* Refactored where the VisibleAvatarURL function lives, to avoid a cyclic
dependency error.
* Originally: (*models.User).VisibleAvatarURL(other *models.User)
* Now: (pkg/photo).VisibleAvatarURL(user, currentUser *models.User)
