Fix browser security warnings

As far as I could tell, Gravatar images were the only assets with mismatch protocol. The existing library we had hardcoded `http://gravatar.com` so I switched to a new one.

I also split up the `grunt setup` task because I kept forgetting to run it with `--force`. So now, you run `grunt setup` once, to initialize the repo, and `grunt update` every subsequent time to pull the latest content repos.