Switch to pyramid_multiauth

Simplify the interaction between annotaton.auth and horus by using
pyramid_multiauth and creating a separate authentication policy for
the annotator auth token.

No longer use cookie fallback for XSRF

This was only needed because the extension was served from a different
origin (chrome: URI), but now we'll be doing authentication in a first
party pop-up. It was probably a bad idea to have this for some obscure
security reason. ಠ_ಠ