development.ini: Add a development-mode session secret

Clean up Streamer.onmessage

- Fix "single player mode" filtering of highlights. It was assuming
  that $scope.persona was an object rather than a string.
- Remove multiple checks to ensure that payload is an array, the
  backend only sends arrays[1][2].
- Convert python style method docstrings to coffeescript comments.

[1]: https://github.com/hypothesis/h/blob/master/h/streamer.py#L562
[2]: https://github.com/hypothesis/h/blob/master/h/streamer.py#L488

Simplified auth plugin

- Bridge the for identity service
- Handles login, logout, and exposes the current logged in user
- permits function for authorizing actions

Privacy directive doesn't fill the permissions if the annotation has
already have them and the replies permissions were not filled, only
the reading permissions

Before that the privacy directive detected that other way.

Fix #1759

Add message about CC0 License to Editor (revision)

Switch to ws4py

... to b8c75146 (typed-packaging branch)

Fixes the shortlink problem with the Document plugin for #1760.

(Also brings in some dead code removal)

Move h.auth -> h.account on frontend

Since pyramid_sockjs seems pretty unmaintained, having fallen behind
gevent-websocket quite a bit, and there don't seem to be any actively
maintained pyramid websocket integration libraries, switch to using
ws4py directly.

This change drops support for non-native websockets. As a result, we
have to do our own JSON decoding of the messages.

We also switch to a `gevent.pywsgi` based worker of our own. This
worker combines the gevent_pywsgi worker from Gunicorn with the
gevent helpers from ws4py that cleanly shutdown sockets on server
termination.

Frontend realtime cleanup

Replaces direct use of the websocket with use of the streamer service
introduced in the previous commit.

This commit adds a streamer service that abstracts interaction with the
streamer websocket.

It's not clear to me why we were using this rather complicated method of
generating a UUID. Suffice to say that simply calling uuid.v4() has much
the same effect.

This isn't used anywhere else, so simplify the interface of Socket by
inlining a call to get the client ID.

... to cfac672e (typed-packaging branch).

Fixes #1788.

... when the bucket bar is being updated
before the document access strategy becomes
available. (This sometimes happens when using
PDF.js in the Chrome extension.)

Raise a error if the ICU ElasticSearch plugin is not installed

Remove an unused event

The original commit that introduced this (by @csillag) does not at
all describe why it was added. Nothing in this project listens
for it.