We decided to publish the client's assets to a Hypothesis-specific
domain because publishers (eg. https://internethealthreport.org) may
want to use CSP to restrict where assets are loaded from and they won't
want to whitelist the whole of npm.

This also gives us better control over caching headers used on assets.