Close #1232

Angular won't see the cookie value when running from the extension
because the app page is served from the extension bundle and is
therefore on a different origin than the backend.

Similarly, Angular doesn't set the header when making cross-origin
requests.

Work around the issue by sending the token in responses from the
backend and setting the header ourselves.

The only way to get information about the location of the annotations
in the document is to request this information from the highlights.

This information can't be read out from the selectors, because anchoring
can place them *anywhere* in the document.

They also can't be read from the anchors, because anchors can contain
any kind of description; there is no mapping to any uniform coordinate
system.

The only way to get this information is to ask the hights for
the coordinates, after they have been rendered.

So this must be done after the second-phase of anchoring; after the
rendering of the highlights in the DOM.

So now we query this info from the highlights (upon rendering
in the host fram), and then store it back into the targets,
which are then sent back to the sidebar, so that this information
is available for sorting.

Fixes #1217.

When an annotation has not been saved yet, it does not have
a real ID. In these cases, it does not make sense to try to
send the empty ID over the RPC channel to try to display the
(yet) non-exisitent annotation card in the sidebar.

There is already some filtering for this on the other side,
but I think it makes sense to filter out invalid element
as soon as possible.

Node code changes, but uses the current syntax
for referencing the sourcemap files from the JS files.

(This makes FF complain less.)

Fixes #1219.
Fixes #1227.

This reverts commit 3607dc428494a62b583d05c2192167146e9c1707.

Fixes #1219.
Fixes #1227.

This library is needed for Internet Explorer compatibility.
The library is smart so it won't do anything unless installed.
And even its install is smart, so it'll detect the browser and
react accordingly.

This reverts commit 20dca37ee333684eb8f86bee722e4d308acea424.

Relates to #1200

1200 auth fixes

Relates to #1200

Relates to #1200

Respond to view value changes by watching the view value on the scope
rather than registering a view change listener. View change listeners
only fire on changes which are valid.

Be careful not to use the directive in combination with ng-hide or
ng-show since the CSS changes subvert the transition.

Improve the conditions for showing/hiding so that it considers the
validity of a field in addition to whether the field is pristine or
dirty.

Relates to #1200

Relates to #1200

Partially revert the changes made in https://github.com/hypothesis/h/commit/c840a620fc040ceb7941c9b50a379b9c271b0728. Fixes #1201.

When annotations are loaded/updated in either side, they will be
automatically transmitted to the other side by the bridbe plugin.

Then on the other side, the new data is merged into any existing one.

The problem is that when doing this merge, some fields (which are objects
themselves) should not be overwritten; they should be merged, too.

This change adds selective handling of the `target` field, which is
a list of objects. Now each individual target is merged, ever overwritten.

Furthermore, there are a few special cases when some fields
(inside targets) should not be updated at all.

Now those updates are refused.

Fixes #1198.

Close #468

Close #1001

Convert {username, provider} objects to strings.