fix(avatars): proxy remote images to appease CSP and canvas restrictions

This adds a proxy for remote images. This fixes the CSP restriction and also the canvas restriction that wouldn't let us export data of a remotely loaded image. The proxy checks to make sure the referer is from our content pages.

Fixes #1469.

@shane-tomlinson r?

@warner f?

@mostlygeek Should we have nginx handle this in production?