Fixing reference to Public access levels to use namespace correctly.
Merge branch 'memberships' of https://github.com/documentcloud/documentcloud into memberships
Send document annotations JSON payload when user logs in

The viewer code wasn't requesting the users private annotations after
they logged in.  Rather than making a second Ajax request after login
simply send the data back along with the login status.
Do not load anything inside inner_iframe initially

Instead wait until it's (possibly) needed by the remote document
viewer.  When and if it's needed the viewer will set the src location
and load the frame then.
IE work for third party logins.

Discovered that IE will not access window.opener if site is
marked as 'trusted' in security settings or if the security
zone has changed for the window, and windowpostmessage can
fail unless a setTimout is used. Documented in comments.
P3P header to authentications controller.

IE will refuse to send/receive cookies from inside an iframe unless
there is a P3P header present.  This causes CSRF validation to fail
and session resets, preventing the viewer login from completing.
Merge remote-tracking branch 'nathan/memberships' into public_notes