Using `$rootScope.$on` to bind event handlers in a controller is usually
going to result in bugs, because:

- The lifecycle of `$rootScope` is that of the entire application --
  that is, it never gets torn down.
- The lifecycle of the controller depends on when and where that
  controller is instantiated. In our case, logging in and logging out of
  the application triggers a route reload[1], which tears down the
  WidgetController.
- WidgetController has no ability to unbind event handlers when it is
  torn down.

Luckily the fix is relatively straightforward. Because this event is
`$broadcast` on the root scope, it propagates to all child scopes. Thus,
we can listen to the event on the controller's local `$scope` and ensure
that the handlers are garbage collected along with the scope when the
controller is torn down.

[1]: https://github.com/hypothesis/client/blob/d6a1392/h/static/scripts/app-controller.js#L71