Move builder image upload feature spec

Lettuce only permits one feature definition per file
Full process builder test script

This is a test script, written using Lettuce's feature/scenario/step
language, based on tests that @jwirfs-brock documented through
screen captures.

I haven't implemented the steps yet, and may not, but this seems like
a helpful, structured way, to manually test the builder.
Use latest Tastypie APIs

Starting with 0.9.12, Tastypie supports a new Authorization API that
supports more granular authorization checks. Functionality in many of the
``Resource``/``ModelResource`` classes also seems to be more factored
out, creating new hooks that can be used for our customizations.

Changes to our API resource and authorization classes include:

Update ``storybase.api.LoggedInAuthorization`` to use new Authorization API
instead of the old ``is_authorized`` and ``apply_authorization_limits``
methods. See
https://django-tastypie.readthedocs.org/en/latest/authorization.html#the-authorization-api

Add an authorization class, ``PublishedOwnerAuthorization`` to
encapsulate object list authorization that is repeated across
a few different resources. At some point, I think it makes the most
sense to move this into custom queryset methods implemented for each
model. This seems preferable to spreading authorization code throughout
the code base.

Move authorization checks out of ``obj_get_list`` as the kind of checks we
need are now possible in the authorization classes

Remove ``DelayedAuthorizationResource`` as the new Tastypie API now natively
offers more granular authorization checks.

Remove ``request`` as an argument from many of the resource methods as it
is no longer passed. In many cases the request is accessible via
``bundle.request``.

Update the signatures for resource class methods so that they accept
the ``bundle`` argument. ``obj_get_list`` is one example of a method where
the signature had to be updated in multiple subclasses.

Replace implementations of ``HookedModelResource`` methods with versions
that mirror the recent ``ModelResource`` implementations where, In many
cases, portions of the code have been factored out into separate methods.

Create an pass an "empty" bundle object in many of the methods of
``StoryBuilderView`` that use resource instances to output JSON to
bootstrap the Backbone views. In some cases, I had to bind the view's
request's user to the bundle's request user so that authorizaiton would
work correctly

Update signature for ``is_valid`` in our validation classes as
``Validation.is_valid`` now takes an optional ``request`` argument
Merge branch '614-latest_tastypie' into develop

This was a topic branch for updating resource and authorization classes
to use the new Tastypie APIs.
Update tastypie dependency to 0.9.15

Prior to this version, there was a weird implementation of
``RelatedField.should_full_hydrate`` that made it difficult to
use resources with related fields outside of a direct request.
In our case, this happens when we instantiate resource classes to
generate JSON to bootstrap the Backbone views in
``StoryBuilderView``.

I had previously implemented a custom field class that patched the
wonky ``should_full_hydrate`` method, but it seems best to just
require working version of Tastypie

Details about the problem and a reference to the commit that fixed
it are in the issue at
https://github.com/toastdriven/django-tastypie/issues/917
Don't automatically add linbreaks for summary

Don't automatically add linebreaks (the ``<br>`` HTML tag) on newline
characters in the story summary on the story detail page.

This isn't needed because the WYSIHTML5 editor automatically converts
newlines in the editor to ``<br>`` tags.

Closes #740
Support multipart/form-data PUT requests to API

I had to patch ``ModelResource.put_detail`` to avoid accessing
``request.body`` (we don't need it anyway) and triggering the
"You cannot access body after reading from request's data stream"
error when the request's format is multipart/form-data.
http://stackoverflow.com/a/12576374/386210  breaks down
what's happening here.

I also had to implement ``AssetResource.hydrate`` to convert empty datetime
fields from empty strings to ``None``. When sending a request serialized
as JSON, the date fields are sent as ``null`` which gets converted to
``None``, but when the requests are sent as multipart/form-data the empty
date fields are empty strings, which causes problems when trying to convert
them to ``datetime`` objects.

Finally I added a note and a copy of Tastypie's license explaining code
replicated from Tastypie and the reasons for this.

Addresses #738
Update changelog

Forgot to update the changelog to reflect the fix for #738
Fixed test script for full story building process
Merge pull request #745 from jwirfs-brock/develop

Fixed test script for full story building process
Add test image

I previously forgot to add the test image needed for the test added in
b6102d2ade6f054f45856bfdc3e671aa26dc1831

Addresses #738
JavaScript syntax cleanup

Clean up problematic JavaScript based on JSHint
Remove list item bullet

Remove list item bullet in Select2 inputs on tag step in builder.
Only send non-null values to server

When sending a PUT request to the API, using multipart/form-data,
only send non-null model attributes. Otherwise, Firefox seems to encode
the null values as strings with a value of "null" instead of empty strings.
This seems to confuse the server-side code.

Addresses #738
Support asset image replacement in IE9

In IE9 (and lower) we have to send data in a form inside a hidden iframe
element. The HTML spec doesn't support using the PUT method in a form, so
we need to implement ``AssetResource.post_detail`` so the server will
accept the request.

Since this breaks the semantics, at least as Tastypie defines them, of a
POST to the detail endpoint, we should only implement this if the ``iframe``
querystring parameter is present.

I refactored some of the code in ``AssetResourceTest`` to avoid repeating
code in the tests for this fix.

Closes #749, addresses #738
Remove debugging statement
Remove dash from window name to support IE

Internet Explorer threw an error when there was a '-' in the window name
parameter to a ``window.open`` call.
Clean up full-process builder test
Remove "Citizen" from comment section

Remove "Citizen" from label of comment section on the story detail page.
This was a holdover from when this project was called the "Citizen Atlas".

Addresses #743
Hide label for comment form

Per request by @jwirfs-brock

Addresses #743