If I was doing this myself, I'd suggest working on js.php. It's taking over 1s to get that single file, which appears  cacheable. An nginx reverse proxy or something comparable would make this way faster. If there are uncacheable parts of this file, then those could be separated out.
It is interesting that the script is loaded async with "defer", so the page is functional (but not ajax-y) before it's loaded. So the long load time isn't quite so bad. But I'd be interested to hear why the whole file isn't just cached.
Also, for a single-page website like this, where all navigations are loaded with AJAX, I'd suggest inlining all the CSS and JS.
Finally, I'd think about making the entire page itself cached. There doesn't appear to be any sort of login, so it's probably feasible. But I'm not sure how the Settings stuff is implemented; if that's persisted server-side then caching the page wouldn't work.
 The Cache-Control header specifies a max-age but not public/private. I honestly don't even know what semantics this has - but it's probably best to make it explicit.
 inlining all CSS and JS, might not be a good idea, as it has several issues related to the same e.g. not being cacheable to start with, parallel resource request etc.
There are several other optimizations possible to reduce the page load time that we could share, though the issue in hand which required immediate attention and seemed to be causing a serious damage to the user's experience was its rendering performance, which we have focused in our discussion.
Here is a run for canIuse using the automated tool - http://www.perfmonkey.com/#/trynow/results/travis/53663113
Here is the result I got - http://www.perfmonkey.com/#/trynow/results/travis/53664194
Here is a test I ran on bootstrap CSS library over all its versions - http://axemclion.github.io/bootstrap-perf