honor default webassets.url_expires
remove unnecessary settings
move the json app state to /app/state no cache

Not every browser supports "Vary: Accept" so it's not a good idea
to try to serve the HTML of the app on the same path as the JSON
endpoint used for syncing the dynamic application state.
add a 'cssversion' webasset filter

With this change, every single asset is now versioned.
bump pyramid_webassets
defer attribute for webfont load

I believe this is the last external resource blocking page loads.