Add tests for authentication policy

Scroll to annotation when clicking at bottom of collapsed quote

Fix 'Location' sort order for annotations

Use require() for templates

For consistency with how other transforms are specified, specify the
stringify transform in package.json instead of in code in the
create-bundle.js script and the Karma config.

Since components now require() their own templates, it is no longer
necessary to use a preprocessor to load them.

Include Angular component templates as strings in the app bundle using
the stringify Browserify transform and use them from directives using
'template' instead of 'templateUrl'.

This is faster, because it avoids going through the async $http
machinery to load templates, but it is also synchronous, which generally
means fewer surprises due to async template loading and specifically in
the context of the <excerpt> directive will be useful as it will make it
possible for the <excerpt> directive to measure the height of its
content in the link function, because all components inside the
exercept's content will have been fully resolved at that point.

Collapsed quotes can be expanded either explicitly by clicking the
'More' link on the quote or 'implicitly' by clicking anywhere at the
bottom of the quote. In that case, the clicked annotation should
be scrolled into view.

This commit separates the behavior when clicking on the toggle link vs
clicking at the bottom of the card.

In the template, the bottom area has been moved before the inline
controls so that the inline controls are above the bottom area and
receive click events first.

1398661 extracted the code for getting a location from an annotation
into a separate module. However that function expects an Annotation but
the sort predicate function was being passed a Thread.

Consequently the predicate function was returning
Number.POSITIVE_INFINITY for every thread and so sort ordering fell back
to the default 'tie-breaker' comparator - which is the original index of
the element in the list being sorted.

Fixes #3106

Postgres Write 2/4: Model code for creating new annotations in Postgres

Live reload development tool for Hypothesis client

If multiple asset bundles are regenerated in quick succession, including
JS or template files, the client might try to reload whilst some of the
bundles are still being regenerated, resulting in the client failing to
load.

This commit reduces the likelihood of this happening by debouncing
live-reload notifications and makes a note of the issue.

This implements support and a test environment
in which the Hypothesis client can live reload
when scripts, styles etc. are changed.

Live reloading when scripts change currently requires
support from the hosting page.

There are two parts to this:

 - A server which serves test pages
   with the Hypothesis client embedded and notifies
   it when front-end assets (styles, scripts) are changed.

   Test pages are served at http://localhost:3000/<any path>
   by default.

 - A small client script which connects to the server and
   listens for notifications of asset changes.

   When styles change it will reload styles for the page.

   When scripts or Angular templates change it will send a
   request to the top-level page to reload.

   This enables reloading to work when changing
   both the sidebar app and Annotator code but also avoids
   the need to manually unload the existing Annotator instance
   before reloading.

CSP violation: admin confirm users delete

Which fixes a CSP violation, but it was also always the preferred
solution. This wasn't done in the first place as we didn't have any JS
bundle set up for admin, that exists now, so it's time to move the
confirmation dialog triggering into the proper place.

Rename postgres_read feature flag to postgres

In order to be able to execute specific JS code on certain admin pages.

So we get reports about JS errors in the admin bundle.

This is particularily important since we introduced a bug in the past
that didn't confirm the users delete form which could have led to
deleting users and all their data without a confirmation dialog.

Make client injection robust to pages that replace the URL fragment as they load

Display 'Show all N public annotations' message when there is a selection

Sites such as Medium and EBSCOHost modify the URL fragment as the page
loads, causing direct-link annotation ID fragments to be lost by the
time the app's init code runs.

When a tab's URL changes, extract the '#annotations' fragment and pass
it to the application as configuration info when the app is injected.
If the URL fragment is removed or replaced by client-side JS as the page
loads, the app will still get the original annotation ID that was
captured by the extension prior to the page load completing.

The direct-linked ID is remembered until the sidebar is successfully
injected, at which point it is cleared so that it is not re-used on the
next navigation within the tab.

Provide a way for the browser extension to pass config info to the app,
by running a content script which injects a <meta> tag into the page
with this form:

  <meta name="hypothesis-config" content="<JSON data>">

This configuration info is then merged with the result of the
hypothesisConfig() function, with the hypothesisConfig() function taking
priority.

When parsing the '#annotations' fragment, ignore any extra content
outside of the url-safe-base64 character set for annotation IDs.

This helps in cases where extra content has been appended to the URL
fragment after '#annotations:<ID>', before the client loads. This
happens at one point during loading of Medium.com pages for example.

Remove incontext links for replies

In the case when the selection has been set as a result of visiting a
direct-linked annotation, this makes it more obvious that there are
other annotations on the page to see.

Uri normalize unicode

Avoid showing 'Clear Selection' or 'Clear Search' buttons whilst loading

When loading annotations whilst a search query is active or selection is
present, avoid showing the 'Clear Search' or 'Clear Selection' buttons
until the search has actually completed and we know whether any
annotations match the query or selection.

This fixes the flash of the 'Clear Selection' button when viewing a
direct-linked annotation.

Fix broken loggedout CTA.

* Create a loggedout-message directive
* Move related html to separate template

https://trello.com/c/dR3qXaxx/257-add-explanatory-text-below-public-focused-annotation-when-logged-out

Preserve URL fragments when redirecting to PDF.js in extensions

Minor copy and style tweaks to the logged-out message

- We prefer "Hypothesis" in prose text to "Hypothes.is"
- Remove unwanted padding at the end of anchors.
- Say "sign in" rather than "log in," as we do everywhere else in the
  sidebar.
- Slight improvement to readability of call-to-action sentence by
  separating the "X or Y" clauses.
- Add a small gap between the two paragraphs.

Reintegrate annotation/document migration

Preserve selection when switching accounts

When visiting a direct-linked annotation (ie. #annotations:<id> is
present in the URL) we want to preserve the selection when the user
signs in, whether the annotation was private or in a group, in which
case they will need to sign in to see it, or public, in which case they
might need to sign in to reply.

Previously public direct-linked annotations became deselected when
signing in because they were unloaded when switching accounts, and this
fired the same ANNOTATION_DELETED event as when an annotation is
removed, which results in the annotation being removed from the
selection.

This commit enables the selection to be preserved by introducing a
different event within the app when annotations are unloaded vs.
deleted. When an annotation is unloaded, it is not removed from the
selection.

Fix a unicode warning

CSP Violation: form input onfocus