Make storage parts independent of Flask

The ElasticSearch wrapper and models can now be used without running the
flask app. Only the REST API needs flask, and has been renamed from
store.py to rest_api.py as 'store' seems too generic.

A few changes were necessary to separate the flasky bits from the
storage part. ElasticSearch configuration was stored in the flask app,
and is now moved to a dictionary `es.config`. When authorization is
enabled, `Annotation.search` needs to know which user to filter the
results for, which was formerly read from `g.user` but must now be
passed as an argument: `authorized_user`.

Mixing query terms and other `search` arguments (like `limit` and
`offset`) together in `**kwargs` seemed a bit shaky to me (keywords
could start overlapping with model fields), especially now
`authorized_user` is also passed as a keyword argument. The query is
therefore to be passed explicitly. Search syntax is a bit uglier now,
sorry about that:

```python
Annotation.search(authorized_user=user,
                  query={'uri':'http://example.com/1234'})
```

In the REST API, query terms are still intermingled with limit and
offset parameters, it is the webapp's task to separate these.
Why not keep using `atoi` here? In particular, why catch the `ValueError`? I don't think we should tolerate non-integer limits being passed.