Fixes #1484

Rework Back End Authentication and Authorization

This fixes a situation where the search bar would not be able to clear
when the last search performed was empty.

Remove negative margin on thread reply counts.

Section, header and footer should be distinct, instead we just use the
cascade in the stylesheet to override the margins.

Instead of using a negative margin to pull the reply count up in line
with the annotation actions, drop the clearfix on the annotation itself
so that the actions don't take up vertical layout space. Restore the
assurance that the actions and reply count don't get too close to the
card edge by putting the clearfix on the thread instead. Also, ensure
consistent use of the annotation-section class to get regular padding
rhythm on the annotation sections.

Fix #1808

Improve Elasticsearch initialization

Remove selection overrides

Email notification revisions

Having the browser text selection behaviour change when it moves over
a highlight is extremely confusing. This change removes that behaviour,
the highlight mixin and brings the PDFjs override file inline with
common.css

Use opaque focus highlights and tweak the rules.

Check cross site request token for WebSocket

http://www.christian-schneider.net/CrossSiteWebSocketHijacking.html

It may or may not be possible to change, but the way the current
highlighter slices the DOM when highlights overlap doesn't always
produce a structure where segments of larger highlights nest outside
segments of highlights that are entirely within their bounds. For
instance, structures like this may result:

    Spans boundaries:       [   ][[ ]][   ]
    Associated annotation:  A   ABA ABA   A

In this example, the range of A completely spans the range of B yet the
inner-most A span is completely wrapped by the B span, with no A span
wrapping them both. If A is the highlight with focus, it is not the
case that a CSS rule can simply neutralize the background color of B.
Therefore, the background color of the inner A span blends with the
background color of B, making the focus highlight less prominent than
it should be.

In this situation, the focus highlight can be guaranteed to be shown
in a clearly visible color by making it opaque. There may be colors
on which this is too low contrast, but until we can investigate other
options this PR makes the focus highlight color opaque to address this
issue.

Additionally, factor out a highlight mixin that makes it all a bit
more readable and consistent.

Fix #1766
Fix #1816

Chrome extension: update packaged PDF.js code to v1.0.907

Change highlight CSS for PDF.js

Put notifications behind a feature flag

Make the auth and settings sections of the app template into blocks so
that they can easily be overridden in inheriting templates. That makes
it possible to split the account and notifications settings into their
own templates without worrying about whether they are applicable for
downstream partners, who can now override the whole block rather than
the account template, for instance.

Pulse annotation cards when updated

Clean up the extension build script

In order to help the user notice updates arriving over the websocket,
this commit causes cards to pulse when they're updated.

If an annotation is part of a collapsed thread, then the pulse will
occur on the first visible parent thread.

Cards owned by the logged-in user will not pulse. This is primarily an
easy way of ensuring that cards don't pulse in the same view as they are
being edited (although it doesn't ensure this in all cases), but it also
makes sense more generally: users don't need to be notified of changes
they have made.

Fixes #1790.

This allows them to be included as a dependency without side effects.

Update PDF plugin

... to 46274663 (typed-packaging branch)

Un-minify dependencies

And only show the notifications panel for account settings when it is turned on

Fix #1762

Default to public visibility on annotations.

Fix #1799

development.ini: Add a development-mode session secret

Clean up Streamer.onmessage