proxies only FB CDN images without a shared secret
CORS headers
handle multiple host wildcards
remove gemfile to avoid heroku process detection