tweak cover image size
allow authenticated static site update

Minimum viable solution for static site updating. Ensures that the
payload is authenticated via HMAC. Currently broken with actual static
site because some magic is needed to route platform.js to the right
location.