Consider the following situation:

- A PDF with fingerprint (F) exists at multiple URLs (U1, U2, ...)
- A user visits the PDF at U1 and annotates it
- A second user visits the PDF at U2

Prior to this commit, due to the way document equivalence for PDFs
functions, the annotations made at U1 will not be loaded, because the
initial search is made for U2 only.

(If the second user subsequently makes annotations at U2, and then
reloads the page, the annotations made at U1 will then show up, as the
association between U2 and F will have been made).

This commit improves the situation here by treating the PDF fingerprint
as the "primary URI" for the document, much as we treat <link
rel="canonical"> URLs as "primary" if we find them in an HTML page.

This means that the initial search will be made for the fingerprint F,
which will match the annotations made at U1.

For more, see:

  https://trello.com/c/DVUemKwi/329-use-pdf-fingerprint-as-primary-search-uri-for-pdfs

In order to make it easier to change the document metadata retrieved for
PDFs, this commit moves the code responsible for extracting that
metadata into a separate (tested) service.

We also remove our reliance on the `PDFViewerApplication.loading` which
was removed from the bundled version of PDF.js in August 2015. Instead
we simply check to see if `PDFViewerApplication.documentFingerprint` is
available. If not, we listen for the first 'documentload' event before
extracting metadata from the `PDFViewerApplication`.

Remove old features from FEATURES_PENDING_REMOVAL

Load annotation from DB in streamer

Add non-nullable and default values to annotation.extra

* Implement new design for hovered conversation threads

Implement the new design for hovered replies from
https://trello.com/c/aXCXxzx2 .

The most visible effect is that conversation threads have a grey
background when hovered.

In the process of implementing the new styling, there is some cleanup
of the CSS:

 * Use `--reply`/`--top-reply` modifier classes on <annotation> and
   <annotation-thread> elements to style annotations, top-level replies
   and nested replies differently. This makes the CSS simpler and
   reduces the risk of unexpected side effects that come with descendant
   selectors.

 * Rename `thread` CSS classes to match the name of the component
   that they are used in, `annotation-thread`.

* Move 'annotation-unavailable-message' styling to app.scss

This class is used in the root template (viewer.html) not the
<annotation-thread> component.

* Darken expand/collapse toggle arrow only when annotation itself is hovered

Darken the expand/collapse arrow when an annotation is hovered but not
when its replies are hovered.

* Remove no-op CSS class

The `clear: both` styling had no effect because <annotation-thread>
is now using flexbox rather than floats for layout.

* Do not show 'Hide replies' link for replies

For replies there were two different ways to collapse the annotation
card, the expand/collapse toggle arrow and the 'Hide replies' link.

Removing the 'Hide replies' link avoids having two ways to do the same
thing and makes the cards look cleaner.

* Remove the light grey background for hovered replies

Following design review, remove the grey background for hovered replies.

* Make rendering of dashed lines to the left of replies better in Chrome

Previously the dashed line started at the top of the <annotation-thread>
component and the top part was covered up by the thread expand/collapse
toggle.

In Chrome the alignment of dashes within a dashed border varies as the
height of the element changes [1]. Therefore depending on the height of
the reply, this could result in the visible part of the line below the
collapse/expand toggle starting at either a gap or dash in the line.

By instead moving the dashed line to a separate element which is
positioned beneath the expand/collapse toggle, the first visible dash in
the reply line always appears in the same place and is aligned correctly
with the annotation content to its right.

[1] See http://www.impressivewebs.com/comparison-css-border-style/
    for a visual representation of why this is done.

This adds an integration test for anchoring of annotations loaded
into the annotator guest via the sidebar.

This was extracted from https://github.com/hypothesis/h/pull/3313

The test case for nested annotations has been marked as an expected
failure until a better resolution for #3278 has been found.

Fix distracting 404s in karma/phantom test output

Use new TokenAuthenticationPolicy and remove cruft

Feature flags cohorts: Add Feature Cohorts admin panel

Add a TokenAuthenticationPolicy for bearer tokens

Remove additional margin at foot of annotation card

Move canonical annotation list sort state to Redux store

This fixes some distracting warnings in the test output.

This is a minor tweak so that we don't try and use CoffeeScripts "x in
y" (which reduces to "y.indexOf(x) !== -1") when y is undefined).

This is a step towards getting us to a place where all important state
in the front-end app is managed in the same way - kept in the Redux
store and modified only via actions.

The sort state was duplicated as a property on the $scope and also
stored in the Redux store.

Instead just expose functions on the scope which retrieve this state
directly from the store and dispatch an action to the store when the
user selects a different sort mode.

In addition, the terminology for sorting has been normalised across the
application (sortBy/sortOptions -> sortKey/sortKeysAvailable), and the
ability to sort the stream has been removed, as it was nonsensical and
broken.

Fix icon spacing

There should be 15px, not 20px of margin at the bottom of the annotation
card, just as at the top.

Removing this CSS means that the annotation footer has no bottom margin
and the 15px is provided for all sizes of the card by padding on
.annotation-card.

The annotation action buttons are inline-block elements which means that
whitespace between the tags results in inserted whitespace in the
document when rendered. This rendered whitespace is roughly 4px wide.

Instead, switch the layout of the annotation actions div to use flexbox,
in which no such whitespace is inserted, and add 4px to the margin on
the buttons.

The annotation action icons didn't seem to be equally spaced due to
excess whitespace on either side of the icons within the font glyphs.
This commit updates the edit, reply and share icons to remove excess
whitespace.

Where previously these three icons were 16px wide (and the trash icon
was 9.5px wide) they are now 14px, 13.5px, and 12px wide respectively.

Use the "HTML" link for the annotation timestamp

The timestamp wasn't originally specified to be switched to the
"in-context" link, so this commit makes sure that it always points to
the "HTML" representation of the annotation, if that link is available.

Fix display of <ul>, <ol> in annotations

URL encode share links

9be804d broke the display of <ul> and <ol> tags in annotation cards by
overriding a bit more than intended -- specifically, it set `list-style:
none;` on <li> in reset.scss when the Compass reset mixins didn't do
that.

This commit fixes the issue by only setting `list-style: none;` on <ul>
and <ol>, which means that the list styles in styled-text.scss can take
effect as originally intended.

The URL query parameter in these links needs to be URL encoded in order
to guarantee that the receiving services can correctly parse the URL.
Sending an incorrectly-encoded URL such as

    http://example.com/hello world.pdf

can result in the parameter just being ignored (by, for example, the
Twitter intent endpoint).

To allow URL encoding strings in Angular templates.

The streamer will now only send the annotation id when the action is
delete. Thus we can't check if the annotation's group is currently
focused when the action is `delete`.

Prepare the direct_linking feature flag for removal

Show adder when the selection changes

Fix client on pages that define a variable called `global`

Modules which assume the existence of a global variable called "global"
(which exists in Node) are wrapped by Browserify during the build which
normally results in "global" being aliased to "self" or "window" in a
browser environment.

If code on the page into which H is loaded defines a global variable
called "global" however, that gets used instead and this can break such
modules. In the case of https://www.civilsprep.com, "global" is a
reference to a DOM node for example.

This commit fixes the issue by only aliasing "global" (as seen by the
module using it) to either "window" or "self" and not to any existing
variable called "global".

Fixes #2723

This is now deployed and enabled for everyone so we can remove the flag.

Make "/app" endpoints relative to serviceUrl

As reported by Donny Donovan from EJP, requests to "/app*" related
endpoints weren't correctly being constructed relative to the configured
"serviceUrl", which makes the client less portable.

This change removes a leading slash from the path supplied to the URL
constructor, ensuring that if "serviceUrl" is not at the root of a
domain, the "/app*" paths will still be correctly constructed.

Extract functions for generating and manipulating observable
streams which are not text-selection-specific out of `selections.js`
into a separate utility module.

When using touch input to manipulate the selection there are no
mousedown/mouseup events that we can listen to and the
touchstart/touchend events are not triggered when manipulating the
OS-provided selection handles in the browser.

Instead listen for selectionchange events and show the adder in
response.

To avoid showing the adder every time the selection handle moves which
would be distracting, we instead buffer selectionchange events and only
show them after a pause.

When the user is using mouse input to make a selection, we ignore
selectionchange events so that the adder does not appear until the user
finishes making their selection.

In preparation for some more complex handling of document events in
order to show the adder when the selection changes on mobile, refactor
the processing of events to use observables.

The zen-observable package is used as a lightweight implementation of
the proposed ES2017
[Observable](https://github.com/zenparsing/es-observable) API.

devserver: Extend ALLOWED_ORIGINS instead of overriding it