Introduce Store resource

This makes it explicit that the function is both a constructor and an
angular resource.

Previously, the text between the markup when the math button was pressed in the markdown editor read $$LaTeX or MathML$$. We don't support MathML, so I've changed it to $$Insert LaTeX$$.

Remove the canAnnotate flag

Refactor WebSocket origin security

Fix MathJax not loading in Chrome extension.

Rather than using the cross site request forgery token in the URL
for the WebSocket, check the HTTP Origin header. All spec-compliant
user agents send a proper Origin header so this is sufficient to
protect users from malicious cross-site access to the WebSocket.

As a consequence, the front-end code to bootstrap the streamer can
be simplified. The streamer no longer has any provider. Its URL and
transport are passed explicitly to the ``open`` method.

While I was here, I added support for the ``protocols`` argument to
the ``open`` method, added support for the ``onopen`` and ``onclose``
handlers, set the client identifier on the ``$http`` service default
headers, aligned the state constants with the standard ones, and
ensured that the socket cannot be closed twice.

Fix small KaTeX display math.

KaTeX default renders math in an inline style. This was creating problems for KaTeX rendered display, and making it looked bunched up and small.

This reverts commit 9e9da30ac4b6c915d2881df20f2f72c0e5be5590.

Introduce Permissions Service.

_acl() is introduce to produce Access-level-control objects from the permissions.
_permits() is just checking if the current user, action is allowed via the ACL list
This way the permits do not have to know anything about annotations