Embed and cookie fixes

Fixed

• Google Analytics cookies are accepted on the project domain.
• The stats screen loads inside cross-origin embeds such as itch.io.
• Card arsenal images stop 404ing.