Remove the canAnnotate flag

Refactor WebSocket origin security

Fix MathJax not loading in Chrome extension.

Rather than using the cross site request forgery token in the URL
for the WebSocket, check the HTTP Origin header. All spec-compliant
user agents send a proper Origin header so this is sufficient to
protect users from malicious cross-site access to the WebSocket.

As a consequence, the front-end code to bootstrap the streamer can
be simplified. The streamer no longer has any provider. Its URL and
transport are passed explicitly to the ``open`` method.

While I was here, I added support for the ``protocols`` argument to
the ``open`` method, added support for the ``onopen`` and ``onclose``
handlers, set the client identifier on the ``$http`` service default
headers, aligned the state constants with the standard ones, and
ensured that the socket cannot be closed twice.

Fix small KaTeX display math.

KaTeX default renders math in an inline style. This was creating problems for KaTeX rendered display, and making it looked bunched up and small.

This reverts commit 9e9da30ac4b6c915d2881df20f2f72c0e5be5590.

Introduce Permissions Service.

_acl() is introduce to produce Access-level-control objects from the permissions.
_permits() is just checking if the current user, action is allowed via the ACL list
This way the permits do not have to know anything about annotations

Previous implementation was flawed that if multiple any terms
were given, every term had to be true inside one field. If couldn't
handle the case when the terms can be found in different fields.

Now any terms are evaluated separately and not bound together.

Fix #1844

To set up stream filter for realtime updates

Fix #1842

This reverts commit 3902a0ba78874861e54c3c51a6b14aca4f75019a.

Fix jumping search icon when loading extension on stream

Remove minimum character limit on tags

Fixes #1484

We were seeing the styles being over-ridden if icomoon.css was injected
after simple-search.scss.

Fixes #1764

This was used before we added the h-icons namespace to our icon font.

Rework Back End Authentication and Authorization

This fixes a situation where the search bar would not be able to clear
when the last search performed was empty.

Remove negative margin on thread reply counts.

Section, header and footer should be distinct, instead we just use the
cascade in the stylesheet to override the margins.

Instead of using a negative margin to pull the reply count up in line
with the annotation actions, drop the clearfix on the annotation itself
so that the actions don't take up vertical layout space. Restore the
assurance that the actions and reply count don't get too close to the
card edge by putting the clearfix on the thread instead. Also, ensure
consistent use of the annotation-section class to get regular padding
rhythm on the annotation sections.

Fix #1808