Refactor back end authentication

Change the authentication to encapsulate it better within the h.auth
package, removing details from h.api and making more idiomatic use
of OAuthLib.

- Move ``h.auth.local`` to ``h.accounts``.
- Move ``h.auth`` to ``h.oauth``.
- Move ``h.interfaces.IConsumerClass`` to ``h.oauth``.
- Drop pyramid_multiauth and replace it with better considered use of
  pyramid_oauthlib.
  - Stop the confusing double-use of 'request.user' by unsetting the
    request property set by horus.
- Fill out the h.auth package.
  - The package configures the authn and authz policies.
  - The lib module holds helpers for constant-type string comparison,
    checking whether a client id refers to the web application and
    fetching client credentials from the database.
  - The tokens module holds helpers for integrating with Annotator.
- Rework consumers.
  - Rename Consumer to Client everywhere but the annotator integration.
  - Make the ``auth`` package responsible for the web client
    credentials, now provided by the settings ``h.auth.client_id`` and
    ``h.auth.client_secret``.
  - Clients can supply their credentials on requests and the client
    credentials grant now works to get an access token, though it does
    not include any authorizations yet.
- Move session configuration to h.session.