R1:68c30e1a714a

Provide a setting which forces all file views to be served from an alternate
domain

Summary:
See D758, D759.

- Provide a strongly recommended setting which permits configuration of an
alternate domain.
- Lock cookies down better: set them on the exact domain, and use SSL-only if
the configuration is HTTPS.
- Prevent Phabriator from setting cookies on other domains.

This assumes D759 will land, it is not effective without that change.

Test Plan:
- Attempted to login from a different domain and…