Webfinger cleanup

we were still checking the deprecated `/.well-known/host-meta` etcetera. now, it only checks

    http://example.com/.well-known/webfinger

or if you specify e.g. `me@localhost:8001` as your user address (which is not a valid webfinger identifier), it will check:

    http://localhost:8001/.well-known/webfinger

with that special option, the starter-kit can run without a TLS cert and on a high (non-`sudo`) port