Use request-scoped rather than thread-local session

Fix missing PDF highlights

fda63b4 unfortunately broke highlighting in PDFs, because the PDF
anchoring code first finds the text in the document, and then uses a
TextPositionSelector and the HTML anchoring code to select a range in
the rendered page for highlighting.

This commit fixes that issue by moving the TextQuoteSelector check up a
level into `Guest#anchor`.

I've added two tests for this in `guest-test.coffee` -- one tests that
annotations where the target contains no TextQuoteSelector are marked as
orphans, and the second tests that the low-level anchoring code is never
called in this case.

I have also removed the integration test, on the basis that I don't
think integration testing failure cases is a good habit to get into.

Fixes #3530.

Update PDF fingerprint searching / handling

Which will then be used as the `target.source` when creating an
annotation.

This will allow us to switch back to using the URL for the
`target.source` when creating annotations, which will then allow us to
link back to the exact document where the annotation was created.

Move test factories into tests/common/

Fix unhelpful username error message when registering a new account

Allow multiple 'uri' parameters to the search query

Clean up the welcome page

Increase the strictness of the heuristic for whether the selection is a
URL or not in the "Convert selection to link" editor toolbar command.

Require the selection to contain something that looks like a scheme
followed by an authority, rather than just a scheme.

Fixes #3513

Fix escaped HTML in login error message

Fix size of sidebar tutorial header

Fix the font size of the sidebar tutorial header. This used to be
smaller, was accidentally made larger.

Fixes #3325.

- Fix incorrect reference to `onShowHelpPanel` property in <top-bar>
   template

 - Do not show URL entry in metadata display if there is no annotation
   guest connected to the sidebar, as is the case in the stream and
   permalink pages.

If you try to login to an unactivated account the error message that the
server returns contains HTML:

You haven't activated your account yet. <strong>Please check your email and
open the link to activate your account</strong>.

Render this client-side as HTML rather than escaping the tags.

Fixes #3501.

In Safari a trailing '#' is appended to URIs extracted from web
documents and PDFs. For URLs this makes no difference as the Hypothesis
search API ignores the fragment identifier. However a URN with a
trailing '#' is considered different from a URN without a trailing '#'.
Since the URI for PDFs is now a URN of the form 'urn:x-pdf:...', when
viewing a PDF in Safari annotations made in other browsers were not
fetched and vice-versa.

The trailing '#' is caused by a bug in the `URL.hash` setter in Safari.

According to section 6.3 of the URL spec [1], setting URL.hash to an empty
string should _remove_ the fragment identifier. In Safari however, it
sets the fragment identifier to an empty string. The result is that when
the URL is serialized, the output is eg. 'urn:x-pdf:aabb#' instead of
'urn:x-pdf:aabb'.

Upstream bug: https://bugs.webkit.org/show_bug.cgi?id=158869
Fixes #3471

[1] https://url.spec.whatwg.org/#urlutils-members

Fix document_uri unique constraint

Rearrange groups views to take advantage of GroupsService

Auto-expand replies for direct-linked annotations

Add a service to manage group creation and membership

Remove unnecessary code for checking type of `annotation.references` field

When direct-linking to an annotation or a reply to one, auto-expand the
annotation thread to make it easier for the user to follow the whole
conversation around it.

 - Convert <simple-search> from CoffeeScript to JS

 - Implement a new set of tests using the createDirective() helper

 - Convert the <simple-search> directive to a modern component-style
   directive which uses one-way bindings and events rather than two-way
   bindings. This makes it consistent with other components in the app.

 - Avoid duplicating the search filter state in multiple places but
   store it only in the Redux store and update it via an action.

The tests for `simple-search` have not been updated in this commit
because they are going to be replaced with a new set using the
`createDirective()` helper in the next commit.

Bugfix: whole page annotation highlights

We now have much more control over how fields are rendered to JSON on
the server and as a result, this field is always either unset or an
array of strings.

Repurposed About panel for Help

Underline links in the Help panel text to make them standout and make
the `/docs/help` URL work when the app is served from browser extensions
extension by prefixing it with the service URL.

Also remove extraneous spaces from around the 'Send us a message' text.

Highlight the specific reply on standalone annotation pages for replies

Reimplement NIPSA operations using NipsaService

Record approximate time-in-queue info for "realtime"

Add some timers to the streamer code

Fixes #3264 with whitespace: no-wrap and flex-shrink: 0

On the standalone pages for replies, indicate the reply which the page
is for by lightening the usernames and bodies of other annotations in the
thread and darkening the username and body of the annotation whose ID
appears in the URL.

Disable a contradictory pep257 rule

Adds hashtag #annotated to web intent