Similar to the situation we ran into shipping the webapp, readonly mode
can and should prevent access to anything under the /ipfs/ endpoint,
which sadly includes profile photos & poster images. To get around this
we'll use the same trick of hiding photos behind vanity urls.

In an effort to avoid API bloat, I've added these as elements of
the previously under-used /profile/photo & /profile/poster GET endpoints.
Both now accept query params for id (which is the profile ID) or peerneme.
this is going to need some refinement & docs, but it'll work for now.

this was causing problems in tests, hopefully it'll clean 'em up.

closes #354

added a quick makefile action to checkout qri repos & update,
and documentation to help fix issues encountered rebuilding qri
after updates.
also bumped circleci to use go 1.10.1, and removed unused deps

closes #313, closes #237

removing a race condition uncovers ANOTHER RACE CONDITION. On the upside
this might be the cause of corrupt profile store file writes, here's hoping.