Use the server_name for local id authority

The dev server now explicitly listens on localhost. That means that
if you wish to expose this publicly you will need to set up a public-
facing proxy server, such as nginx, or create/modify a .ini file.

The Procfile still uses 0.0.0.0, which means that pyramid will fall
back to reading the HTTP Host header for the server name. In Procfile
deployments like heroku and dokku it is assumed that this header is
trusted and fixed in upstream reverse proxies.

Fixes #497.
Register the Annotation class with an interface
Take over the groupfinder authn callback

Horus uses 'user:<id>' as the principal name assocatied with a user.
Since we use 'acct:<username>@<provider>' everywhere else, let's use
that here to save us some converting.
Add an ACL for the Annotation resources

With this change we're pulling the annotator-store authz model into
line with pyramid.security so we can leave annotator-store (and
h.api.store by extension) well encapsulated and isolated from the
rest of the application.
Publish store events with the Annotation class
Use pyramid for store authz
Use pyramid.security to check streamer authz

Fixes #574
Merge pull request #590 from hypothesis/574-pyramid-authz

Take control of the annotator-store authorization using Pyramid ACLs.