Cache static files by hash

Implements #2734.

Deployment note: `GRATIPAY_ASSET_URL` needs to be changed to `https://assets.gratipay.com/` on Heroku. I don't think we'll need to change anything on the CDN side, can you confirm that @whit537 ?
> In theory you shouldn't have to send Cache-Control for a 304 -- the recipient should just continue to use the cache directives that it received from the original 200. However, as you've found, in practice if you don't keep sending Cache-Control, browsers will ignore the cache directives that you sent originally, and revert to their own default heuristics.
> 
> So in practice, you should include the same Cache-Control with a 304 that you would with a 200. The spec only mandates that you send it for a 304 if it's different than what you sent previously (see 10.3.5 304 Not Modified) -- but it certainly doesn't forbid you from repeating it when it's the same.

http://stackoverflow.com/questions/1587667/should-http-304-not-modified-responses-contain-cache-control-headers