gravatar-time: accept a size parameter
environment.js: more content security policy
add timeline template and controller; user/index now renders all tweets into timeline; routes/user fetches all tweets async when setting up the controller - does not block profile rendering