store: Don't allow id in create requests

This fixes #82.
Update CHANGES to detail changes in 0.11.2
Add failing test for authz in index (/annotations)
Fix authorization for index (/annotations)
Exclude id field from _source

Fixes #78
Fix (seemingly unrelated) bug in test_annotation

For some reason, by introducing the `'_source':{'excludes':['id']}`,
suddenly Elasticsearch does not store empty objects into arrays in the
`_source` anymore. Elasticsearch bug?
Make Elasticsearch read _id from the id field

Achieved by specifying a `path` in the mapping for `_id`.
See http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-id-field.html
On save, set op_type to 'create' in absence of id
Add tests for op_type
Remove superfluous ann.id alias for ann['id']