Allow //y.vg script to be hosted elsewhere

[dancrew32]

Noticed the //y.vg here:
https://github.com/mandatoryprogrammer/xsshunter/blob/master/api/apiserver.py#L64

I understand that it's a convenience to host this script externally, but it might be nice to decouple this app from a third-party url. I was thinking about os.environ.get('XSS_SERVER_SCRIPT_URL', '//y.vg'). Sound okay?

[mandatoryprogrammer]

This header actually does nothing hehe, it can be removed from the script. Feel free to submit a pull request if you'd like it removed (I'll merged it).