http://www.christian-schneider.net/CrossSiteWebSocketHijacking.html

Clean up the extension build script

Update PDF plugin

... to 46274663 (typed-packaging branch)

Un-minify dependencies

Default to public visibility on annotations.

Fix #1799

development.ini: Add a development-mode session secret

Clean up Streamer.onmessage

- Fix "single player mode" filtering of highlights. It was assuming
  that $scope.persona was an object rather than a string.
- Remove multiple checks to ensure that payload is an array, the
  backend only sends arrays[1][2].
- Convert python style method docstrings to coffeescript comments.

[1]: https://github.com/hypothesis/h/blob/master/h/streamer.py#L562
[2]: https://github.com/hypothesis/h/blob/master/h/streamer.py#L488

Simplified auth plugin

- Bridge the for identity service
- Handles login, logout, and exposes the current logged in user
- permits function for authorizing actions

Privacy directive doesn't fill the permissions if the annotation has
already have them and the replies permissions were not filled, only
the reading permissions

Before that the privacy directive detected that other way.

Fix #1759

Add message about CC0 License to Editor (revision)

Switch to ws4py

... to b8c75146 (typed-packaging branch)

Fixes the shortlink problem with the Document plugin for #1760.

(Also brings in some dead code removal)

Move h.auth -> h.account on frontend

Since pyramid_sockjs seems pretty unmaintained, having fallen behind
gevent-websocket quite a bit, and there don't seem to be any actively
maintained pyramid websocket integration libraries, switch to using
ws4py directly.

This change drops support for non-native websockets. As a result, we
have to do our own JSON decoding of the messages.

We also switch to a `gevent.pywsgi` based worker of our own. This
worker combines the gevent_pywsgi worker from Gunicorn with the
gevent helpers from ws4py that cleanly shutdown sockets on server
termination.

Frontend realtime cleanup

Replaces direct use of the websocket with use of the streamer service
introduced in the previous commit.