Make thumbnail URLs protocol-relative.

The thumbs domains are now SSL-capable. This de-duplication also brings
explicit width/height to .compact thumbnails and gets rid of a bug where
<img src="nsfw"> was generated in .compact.
Make OAuth app icon URLs protocol relative.

The thumbs domains are now SSL-capable.