Include 'authority' argument in call to API endpoint

When the user is on a page using 3rd party accounts but is not logged
in, they will not have an access token.

In this case, the 'authority' argument provides a way for the service to
determine which authority-specific groups and preferences should be
included in the returned profile.

src/sidebar/session.js

@@ -84,8 +84,12 @@ function session($http, $resource, $rootScope, annotationUI, auth,
       // the /app endpoint.
       lastLoadTime = Date.now();
       lastLoad = retryUtil.retryPromiseOperation(function () {
-        if (Array.isArray(settings.services)) {
-          return store.profile().then(update);
+        var authority;
+        if (Array.isArray(settings.services) && settings.services.length > 0) {
+          authority = settings.services[0].authority;
+        }
+        if (authority) {
+          return store.profile({authority: authority}).then(update);
         } else {
           return resource._load().$promise;
         }

src/sidebar/test/session-test.js

@@ -174,6 +174,12 @@ describe('session', function () {
       });
 
       it('should fetch profile data from the API', function () {
+        return session.load().then(function () {
+          assert.calledWith(fakeStore.profile, {authority: 'publisher.org'});
+        });
+      });
+
+      it('should update the session with the profile data from the API', function () {
         return session.load().then(function () {
           assert.equal(session.state.userid, 'acct:user@publisher.org');
         });

src/sidebar/test/store-test.js

@@ -148,11 +148,11 @@ describe('store', function () {
 
   it("fetches the user's profile", function (done) {
     var profile = {userid: 'acct:user@publisher.org'};
-    store.profile().then(function (profile_) {
+    store.profile({authority: 'publisher.org'}).then(function (profile_) {
       assert.deepEqual(profile_, profile);
       done();
     });
-    $httpBackend.expectGET('http://example.com/api/profile')
+    $httpBackend.expectGET('http://example.com/api/profile?authority=publisher.org')
       .respond(function () { return [200, profile, {}]; });
     $httpBackend.flush();
   });