use subdomain to serve static assets

[markkap]

This will be another approch to solve various exploits including enabling unsanitized SVG, and will reduce the number of cookies sent all around.

This should be a suggestion to the user that a user can configure.