Urg.. JST doesn't support inline comments
Merge branch 'public_notes' into memberships
Only attempt to load document's annotations if account is logged in.

This is much more efficient and will reduce load on servers. Thanks Ted!
Extend Document#canonical to include annotations_url endpoint

If document's status is PRE/POST moderate or an account that has
permissions is present, include an annotations_url endpoint on the
document's canonical representation.

Right now it's defaulting to an agnostic protocol (no http or https specified), but
may need to be forced to use https in future
Fix for missed renamed variable 'annot'->'note'
Annotations endpoint requires SSL.

Since annotations require a login and the session cookie is set as secure.  Non ssl attempts fail login check.
Don't remind users that they are already logged in, just tell them it worked fine
new version of viewer that uses annotations_url endpoint