Refactor back end authentication

Change the authentication to encapsulate it better within the h.auth
package, removing details from h.api and making more idiomatic use
of OAuthLib.

- Drop pyramid_multiauth and replace it with better considered use of
  pyramid_oauthlib.
  - Remove the need to list h in 'pyramid.includes'.
  - Stop the confusing double-use of 'request.user' by unsetting the
    horus property.
- Fill out the h.auth package.
  - The __init__.py has the configuration of the authn and authz
    policies.
  - The utils module holds helpers for constant-type string comparison,
    checking whether a client id refers to the browser application and
    fetching client credentials from the database.
  - The tokens module holds helpers for integrating with annotator.
  - The grant_types sub-package has a jwt_bearer module that implements
    draft-ietf-oauth-jwt-bearer.
- Support multiple storage consumers.
  - Treat clients and consumers as separate aspects of the request.
  - Set the 'consumer' property on requests inside the OAuthLib
    machinery.
  - Pass the consumer key to search operations so that consumers are
    isolated to a world with only their annotations.
  - The default consumer is the same as the API client and is the
    public instance of the annotation storage service.
  - All access tokens are issued by this API client.
  - Single Sign On consumers can use the JWT grant to override the
    consumer and gain access to their own, sandboxed storage.
  - Move remaining helpers out of h.api.
- Move session configuration to h.session.
- Start to fill out h.security with OAuth scope constants.