Do not fill annotation.user

h/static/scripts/controllers.coffee

@@ -141,10 +141,6 @@ class AppController
 
     $scope.$watch 'auth.user', (newVal, oldVal) ->
       return if newVal is undefined
-      # Annotator needs to access the user property without the permissions
-      # plugin and since auth service depends on annotator, the annotator
-      # service cannot use the auth service
-      annotator.user = newVal
       reset()
       $scope.login() if isFirstRun and not (newVal or oldVal)
 

h/static/scripts/services.coffee

@@ -254,7 +254,7 @@ class Hypothesis extends Annotator
     @element.scope().$evalAsync angular.noop
 
   beforeAnnotationCreated: (annotation) ->
-    annotation.user = @user
+    annotation.user = @element.injector().get('auth').user
     annotation.permissions = {}
     @digest()
 
@@ -322,7 +322,7 @@ class Hypothesis extends Annotator
         delete query.user
       when "single-player"
         if @user?
-          query.user = @user
+          query.user = @element.injector().get('auth').user
         else
           delete query.user