Earlier the notification system swallowed some notifications for private annotations.

* Style the cursor above the notification counter exactly as above tri (w-resize and rw-resize, depending on sidebar state)
* Make it react to clicks

- Slightly smaller to better fit everywhere.
- Slightly transparent in summary view, so as not to draw to much
  attention.
- Kill the border radius.
- Improve the vertical alignemnt of the input box.

Closes #599 by squashing.

Feature cocktail for current Demo

Notification throws out not relevant annotations when the social view mode is set to 'single-player'

- Added font family
- Bottombar has it's height decreased
- Centering the changes for the center of the speech bubble icon

- Flashes for new notifications.
- Notification number is counted in the bubble.

- Graphical design is missing
- Fix for refreshing synonims is missing

Now the Hypothes.is class has a field called 'socialView',
which specifies the social view filters that should be used.

This is considered when loading annotations on init, and also on
later re-loads, because of login/logout.

When the filter is changed, annotations are automatically reloaded.

(And there were also some cosmetic fixes.)

Manually cherry-pick some changes from

https://github.com/hypothesis/h/commit/c2286994a215283addd86170851e4cabf3e97ca9
https://github.com/hypothesis/h/commit/1ff5505f3b019e2abd21b6920a388d798c0acc58
https://github.com/hypothesis/h/commit/fa9351f02c996cebf8a10f1ef8bb8bbaa1035286

This partially takes care of
 * Problem 1 described in #578. (The two code path are not yet consolidated, but at least now they do the same)
 * Problem 3 (The reloading is now a separate method.)

Implement search tool

Take control of the annotator-store authorization using Pyramid ACLs.

The dev server now explicitly listens on localhost. That means that
if you wish to expose this publicly you will need to set up a public-
facing proxy server, such as nginx, or create/modify a .ini file.

The Procfile still uses 0.0.0.0, which means that pyramid will fall
back to reading the HTTP Host header for the server name. In Procfile
deployments like heroku and dokku it is assumed that this header is
trusted and fixed in upstream reverse proxies.

Fixes #497.

and using $element.find() instead of $()

- Font is bold, size: 11px