Wait for feature flag data before loading sidebar view

Document link refactor

Clear the features cache only when the logged-in user changes,
rather than on any change to session data.

Feature flags can affect the initial search query when
the app loads. eg. If the groups feature is enabled then
we will by default load annotations for the most recently
used group, otherwise we'll load public annotations.

Therefore, wait for the feature flags to be retrieved
before loading the view.

The feature flags endpoint is very fast so the behavior
was correct most of the time previously but occassionally
the app would load and fetch Public annotations before
the feature data was available which would have resulted
in fetching group annotations.

At the same time, this clears the feature flag data
when the current user changes and fixes an issue where
switching from a non-groups enabled account to a groups-enabled
account did not immediately update the UI.

Fixes #2675

Fix exception when GROUPS_CHANGED event is broadcast during route load

The <group-list> directive attempted to update itself in
response to a group change notification without triggering
a full digest cycle by using `$scope.$apply`.

This was based on the incorrect understanding that $apply only
dirty-checks the current scope downwards. In fact, in dirty-checks
the root scope. Additionally, the logic was pointless since
group list/focus changes happen in response to two types of events,
both of which are triggered in the context of $apply:

 * An event handler when the user selects a group

 * A callback from angular-websocket when a WebSocket message
   is received.

Avoid route reload on groups list change

Angular 1.4.x introduced a breaking change (undocumented in the
upgrading guide as far as I can tell) to the way URL query parameters
are handled in ajax requests.

Specifically, semicolons in query parameter values are no longer encoded
by default. This causes problems for us in request urls such as

    /api/search?uri=http:%2F%2Fexample.com/?id=4;display=print

because Pyramid interprets the semicolon (correctly according to
RFC3986) as a query string delimiter.

This commit fixes the issue by overriding the default parameter
serializer (although only for the ngResource objects in the store
service) with a much more conservative one that encodes everything with
`encodeURIComponent`.

The bulk of the code here is a slightly modified version of the default
serializer used by Angular.

Avoid maintaining a copy of the groups list and focused group
states in the directive as per the discussion at
https://hypothes-is.slack.com/archives/public/p1446048142004464

A style for anchor tags was moved from `common.scss` to `elements.scss`,
and so we now need to include that here.

Remove the remnants of a defunct annotation pulse feature

Remove the remnants of a once-functional visual diff feature

When the <groups-list> directive is instantiated,
login is not complete and the groups list contains only
the Public group.

Once the login completes, the groups list was updated
because GROUPS_CHANGED was not broadcast for the initial
groups load. The reason for this was to avoid an unnecessary
route reload in `AppController`.

Resolve this by always firing the `SESSION_CHANGED`,
`USER_CHANGED` and `GROUPS_CHANGED` events when
they change, but include an additional piece of data
indicating whether this is the first load or not. This is used
in `AppController` to avoid an unnecessary route reload.

Another feature that used to work but now doesn't. Remove the code for
now, as it's just bloat that is, at best, doing nothing.

When the client receives a notification that the
list of groups changes, update just the groups list
and, if necessary, focused group rather than reloading
the whole view.

This is done by splitting the SESSION_CHANGED event
into finer-grained GROUPS_CHANGED and USER_CHANGED
events. The <groups-list> directive now listens for
GROUPS_CHANGED and updates itself in response.

This fixes an issue where joining or leaving a group
would always result in unsaved changes to annotation text
being lost.

If the user leaves a group which is currently focused and
which has an unsaved changes to an annotation, that will still
result in changes to the annotation being lost.

 * Add finer-grained GROUPS_CHANGED and USER_CHANGED
   events which components can react to.

 * Avoid directly exposing the groups service to the
   <group-list> template and instead only expose
   the required methods. This makes it easier to
   track what is going on in the template.

Fixes #2641

Merge pull request #2667 from hypothesis/trello-144-add-a-list-of-most-recently-annotated-by-the-group-urls-to-the-group-page

Trello 144 add a list of most recently annotated by the group urls to the group page

Once upon a time, we could show a diff between what the annotation has
anchored to in the page and the original selected text. That feature has
been non-functional since at least 4f60030.

Adjust the top-most position of entries in the bucket bar

Fix display of the (new) top bar for signed-out users

Adjust the top-most position of entries in the bucket bar
to accomodate the height changes in the toolbar as part
of a recent design update.

Fixes #2646

Using ng-show causes the items in the list to be displayed incorrectly
-- the :first-child rule removing the separator bar does not apply,
because there is another element (hidden) in the dropdown list.

- Show the focused group ("Public") when signed-out, without allowing
  the user to change it.
- Show a "Sign in" link in the right place, with the correct padding.

Merge pull request #2678 from hypothesis/trello-135-while-drafting-an-annotation-the-group-name-or-lack-thereof-should-reflect-its-current-visibility

Show "Only Me" when editing a private annotation

At the top of an annotation card is a line that says something like:

    seanh to (g) Foo (l) Only Me

if it is a private annotation in group foo. (g) is the group icon and
(l) is the lock/privacy icon.

For some reason the (l) Only Me part was only being shown when _not_
editing the annotation.

This fixes it to always be shown. So when creating or editing an
annotation, if you select Only Me in the Post dropdown then (l) Only Me
will appear in the annotation title, if you select the group (or Public)
then Only Me will disappear.

To match the latest mockup from Conor. This basically involves making
the group share page look a lot like the group create page already does.

Do not change focused group when clicking 'leave' icon

Fix flash of Clear Search/Selection buttons after failed sign-in

Move signin control into its own directive

This commit moves the signin and account control (and dropdown) into its
own directive.

To make it easier to understand what's going on at load, I've also
changed the signalling of user signed-in/signed-out state to an explicit
`status` field on the `auth` object, rather than relying on a tristate
of {undefined, null, user object}. This results in templates that are
marginally more verbose, but substantially clearer in intent.

Lastly, I've moved the computation of the `username` and `provider`
properties into AppController so that it doesn't need a `$scope.$watch`.

Fixes #2663

 * Add missing test that checks that canceling the 'leave'
   prompt does not leave the group

 * Add failing test that checks that leaving a group does
   not change the focus

This is labeled `ng-if="groupsEnabled"` but is within an entire section
which is labeled `ng-if="!groupsEnabled"`.

When an app reload occurs, the 'Clear Search' and
'Clear Selection' buttons would sometimes flash.

This occurred due to an issue where the initial
call to the watcher registered by ng-show to hide
the buttons being invoked asynchronously in some cases.

When the app's route is loaded, the following happens:

 1) viewer.html is compiled
 2) viewer.html is linked
 3) Watchers registered by directives during (1) and (2)
    are run. For the watchers registered by 'ng-show',
    this applies the .nghide CSS class that hides
    elements.

On initial app load, 1-3 all happen synchronously in the
same scope.$digest cycle. However, when logging in with
an incorrect password, 1 & 2 happened in the same cycle
but 3 happened in a separate cycle, with DOM rendering
taking place in a flash between before the directive
was fully ready.

The GitHub issue has more detail and there is some
connection to the 'deepCount' directive but I decided
not to alter that here without sufficient understanding
of the consequences.

This commit fixes the issue by applying the 'nghide'
class to the viewer.html initially and then letting
ng-show _remove it_ when its watcher runs. This fixes
the flash when 1-2 and 3 happen in separate digest cycles
and has no effect if they run in the same cycle.

Fixes #2642

Turn on pyramid's conditional_response machinery

Replace hashids with pubids

Fix extension clobbering embedded H