All resource artifacts should be loaded via CloudFront not S3

In order to maximise the edge caching functionality of CloudFront, all of the URLs used to retrieve assets, e.g. thumbnails, videos, PDFs, etc should be done via CloudFront and not directly from the S3 bucket.

Note that this may break things - see where retrieval via CloudFront isn't working but via S3 is working ... so care needs to be taken.