Fix hot-linking protections against own site (when not in root dir)

The `site_url()` template tag retrieves the site url for the current
site (where the WordPress core files reside). Use this to get the
"WordPress address" as defined in general settings.

Use `home_url()` to get the "site address" as defined in general
settings.

See: https://codex.wordpress.org/Function_Reference/site_url