Revert "Add .DS_Store to .gitignore"

This reverts commit 3c5952ddacbfd883ce9f0ea0a2f317a47670de39.

Per feedback from @aron
https://github.com/hypothesis/h/commit/3c5952ddacbfd883ce9f0ea0a2f317a47670de39#commitcomment-8916616
Set elasticsearch requirement higher

Plugin listing support (which we use as of
244130c925d66efd2cf84fe972d452ad9cd5c313)
was added in elasticsearch 1.1.0.
Stripping plugin names after the split

Otherwise it was failing due to a trailing space
after `analysis-icu`
Update Elasticsearch Version

I also included specific instructions for getting elasticsearch to start automatically when the system is booted.
whitespace
Refactor back end authentication

Change the authentication to encapsulate it better within the h.auth
package, removing details from h.api and making more idiomatic use
of OAuthLib.

- Move ``h.auth.local`` to ``h.accounts``.
- Move ``h.auth`` to ``h.oauth``.
- Move ``h.interfaces.IConsumerClass`` to ``h.oauth``.
- Drop pyramid_multiauth and replace it with better considered use of
  pyramid_oauthlib.
  - Stop the confusing double-use of 'request.user' by unsetting the
    request property set by horus.
- Fill out the h.auth package.
  - The package configures the authn and authz policies.
  - The lib module holds helpers for constant-type string comparison,
    checking whether a client id refers to the web application and
    fetching client credentials from the database.
  - The tokens module holds helpers for integrating with Annotator.
- Rework consumers.
  - Rename Consumer to Client everywhere but the annotator integration.
  - Make the ``auth`` package responsible for the web client
    credentials, now provided by the settings ``h.auth.client_id`` and
    ``h.auth.client_secret``.
  - Clients can supply their credentials on requests and the client
    credentials grant now works to get an access token, though it does
    not include any authorizations yet.
- Move session configuration to h.session.