login: fix permission issue for guest user

* Fixes a permission issue where a guest user did not have a list of
  permitted restricted collections calculated, causing issue with
  e.g. facets when viewing restricted collections (e.g. restricted to
  role anyuser).
Records: enhance the API to create empty records

Signed-off-by: Esteban J. G. Gabancho <egabancho@gmail.com>
JSONAlchemy: enhance default value search

* Additionally to setting the default value, the meta-metadata for the
  field is guessed from the field definitions following this rule
  order: `creator`, `derived`, `calculated`. If none of them is found
  every meta-metadad field is set to `UNKNOWN`.

* Convenience property `additional_info` added to SmartJson

Signed-off-by: Esteban J. G. Gabancho <egabancho@gmail.com>
jsonalchemy: refactoring fixes

* Fixes issues in jsonalchemy found during testing deposit module.
access: minor fix
oauth2server: initial release

* Initial release of OAuth2 provider for Invenio.
webhooks: initial release

* Adds REST API endpoint for receiving webhooks notifications
  from external services and pass the request payload to a
  Celery task for background processing.

Signed-off-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
restful: apikey and oauth2 authentication support

* Adds support for API authentication via both API keys
  and OAuth 2.0.

* Adds pending deprecation messages to API authentication, which
  will be replaced by OAuth 2.0 personal tokens authentication.

* Fixes an issue where API response headers would include a
  set-cookie header.

* Aligns unauthenticated response status code to 401 for API key and
  OAuth authentication.

* Downgrades empty session log message from error level to debug
  level.

Signed-off-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
accounts: blueprint move

* Moves blueprint to separate package.