made the #nginx config a little better, converted thin to bind to a domain socket, and deployed with a dedicated app user with deploy keys #win