don't build flashlight; just download it from S3
refactor out proxy ufw rules
adapt upstart script to new calling scheme

Also refactor out the getiantem.org domain to a 'zone' jinja variable
to avoid duplication.