Add p3p header to DocumentsController#show

Move the set_p3p_header method from authentications controller to a
protected method on the application controller so it can be shared
between all controllers who may be embedded in an iframe.

This should provide a solution for issue #39
Fix accidental assignment.
Use account's send_login_instructions to resend welcome email

The send_login_instructions also calls
LifecycleMailer.deliver_login_instructions but first makes
sure the security_key is set.

It's possible for an account to be created without a key,
which causes problems if the welcome email is resent later.
Test for existence of organization.id in query results

On organizations other than the 'primary' the
Organization.populate_members_info method is called with account to
exclude

If they are the only member of that organization, it will then be
excluded from the query results because we're performing an inner join and
there's no matching rows on the accounts side of the query.

This tests for it's existence and sets the members to an empty array otherwise
Merge branch 'hotfix' into annotation-moderation