The frame-rpc module is a proper CommonJS module and it's footprint
is really tiny. Its protocol is simpler. It doesn't handle connection
and buffering, but with our onConnect callback we don't need buffering.
The connection handshake that jschannel did was so trivial it's been
re-implemented here (each side tries to connect to the other once).

We have to handle timeouts ourselves, but that's all hidden in the
bridge code. In exchange, we get a simpler API, we get rid of the
call/notify distinction in favor of just passing a callback or not
and we avoid the excess overhead of the recursion guard in the
serialization code that was giving us false positive issues with
the document title.

This is one step toward removing all the browserify-shim requiring
libraries from the injected bundle, which will eventually fix #2397.

Remove vendored assets: install from NPM

Replaces our vendored dependencies with dependencies on packages
installed from NPM. This makes it substantially easier to find out
what versions of 3rd-party packages are installed, and substantially
easier to upgrade them as and when necessary.

Libraries have been installed pinned at the version available on NPM
nearest that installed in the repository. This means:

- angular remains v1.2.28
- angular-animate was upgraded from v1.2.25 -> v1.2.28
- angular-resource was upgraded from v1.2.25 -> v1.2.28
- angular-route was upgraded from v1.2.25 -> v1.2.28
- angulartics remains v0.17.2
- bootstrap remains v3.3.5
- jquery remains v1.11.1
- jstimezonedetect remains v1.0.5
- moment remains v2.5.0
- moment-timezone remains v0.0.1
- ng-tags-input remains v2.2.0

Unfortunately, the following modules don't appear to be available on NPM
and so remain in the repository:

- angular-bootstrap
- angular-sanitize
- angular-toastr (at a version early enough)

Enable users to create groups

This commit adds a list of groups to the "topbar" when the groups
feature flag is enabled.

Limit what admins can do

Use browserify-ngannotate to provide injection annotations

Only update stream filter when we have >0 URIs

Rather than trying to keep injection annotations up-to-date manually, we
can use the computer to do it for us.

[browserify-ngannotate][1] is a browserify transform plugin that uses
[ng-annotate][2] to automatically generate injection annotations for the
Angular injector.

[1]: https://github.com/omsmith/browserify-ngannotate
[2]: https://github.com/olov/ng-annotate

The backend code in `h.streamer` assumes that the arguments to "one_of"
are either a non-empty list or a single value. Passing an empty list
causes the generation of a bogus query.

So, don't update the stream filter until we have at least one URI to
stream from.

Fixes #2257.

Update to the latest packaging changes of the anchoring helper modules
that now specify a browser field and browserify transforms in their
package.json files. This bypasses the UMD wrapper of these modules,
saving bytes and avoiding the need to wrap them with browserify-shim.

Even when used as a CommonJS module, angular installs itself globally.
Rather than fight this in our tests, just leverage it. The mocks module
also installs itself under angular.mock. Therefore, none of the require
statements for angular or angular-mocks are necessary.

It turns out we don't need Sinon-Chai because we only use the assert
interface. According to the Sinon-Chai docs:

    For assert interface there is no need for this library.

Instead, we just install the assertions into the assert object.

There's no reason to have these methods have a different name in the
guest as the host. The implementation should be opaque.

Reload annotations on auth change

Just because the user has permission to read an annotation does not
imply that it should still be visible under the current search after
the authentication change. An example of this is when a NIPSA flagged
user logs out but has public annotations visible.

Two front-end fixes

- Collapsed threads don't show tags
- Collapsed threads should have space between user and reply count
- "Sign in required" card should have symmetric vertical margins

Consolidate and style the admin interface

While the URL object stringifies nicely, meaning this does work,
it is liable to confuse request interceptors that expect a string.

This commit brings together "administrator" views into one place -- the
Hypothesis admin console, found at /admin.

So far, the only to admin views we have are for flagging/unflagging
users as NIPSA, and for administering administrative user status. In the
near future, we may also have a feature flag console in here.

- I've moved all the admin views into `h.admin` so that we don't
  confused business logic view functions with administrative view
  functions, and so that in future it is easier to treat the `/admin`
  tree as a single entity for the purposes of permissions, etc.
- I've added an "admin" page layout, which uses Twitter Bootstrap for
  basic styling.
- I've rejigged both the NIPSA and the administrator users pages to make
  use of bootstrap.

Update Firefox extension for Jetpack Manager tool

Simpler session service

Rather than using a separate named value to keep track of the current
CSRF token, simply treat this as part of the session state.

This commit does three things. In order of importance:

- wraps the ngResource for managing session state in a service, which
  allows us to expose current session state as `session.state` on that
  instance. This means that components of the application that don't
  want to alter or explicitly fetch session state, but wish to display
  some part of it (such as the current authenticated userid, etc.) can
  do so more easily.
- moves configuration of the session resources into the session service
  rather than requiring configuration from outside via a
  sessionProvider.
- translates the session service to JavaScript from CoffeeScript.

Fix infinite digest cycle caused by feature flag client

This was a fun bug. If multiple feature checks are done in rapid
succession when the features cache is empty (such as, for example,
during the first digest cycle at application boot time) then the
features client would keep kicking off HTTP requests until the first one
returned.

This would clearly be a misfeature, but wouldn't actually have caused
any problems but for the fact that the spinner in
`h/directives/simple-search.coffee` does this to determine whether to
spin:

    scope.$watch (-> $http.pendingRequests.length), (pending) ->
      scope.loading = (pending > 0)

This means that kicking off dozens of requests at a time keeps
invalidating the digest cycle (because the value of
`$http.pendingRequests.length` keeps changing), so it never ends. The
result is the ever-horrible `infdig` (infinite digest cycle) error from
Angular: https://docs.angularjs.org/error/$rootScope/infdig.

The angular $httpBackend mocking service supports two primary means of
usage:

   .expect(...).respond(...)

and

   .when(...).respond(...)

The latter pattern allows a single handler to respond to multiple
requests, in any order. The latter is precise -- one .expect() must be
matched by one request, in the correct order.

This commit changes the tests for the "features" service to use this
more precise form of testing.

PDF usages might want to specify relative URLs to get around proxy
restrictions with a custom viewer. Even link tags support relative
URLs for rel=canonical though it's probably a bad idea as a publisher.
In any case, we should clearly just do this.

Make Makefile more dumb

Add support for flagging user accounts as "not in public site areas"