prefer https for fonts
use content security policy to deal with trackers, social media buttons, etc.
add rspec/capybara stubs. Currently broken because Ruby segfaults on the forwarded HTTP requests :(