when pruning Response.activity_json, keep the to field if the activity isn't public

also de-dupe fields between activity and object
fix HEAD requests for handlers that pass args
unify extracting domain in signup to use get_webmention_target()

only one user visible change: domains on user pages no longer have www. prefix