Move link-ify unlocked-acts logic out of server to web JS.

Because not all clients are webbish, embedding all
that <a href=""> crap in the response was unhelpful.