Adapt annotator auth into local oauth provider

This pull request adapts our current authentication scheme to simplify it, make it optional, and pave the way for more flexibility to integrate with other identity providers.

- Move everything horus-related to a new sub-package `h.auth.local`
- Drop the `AuthTktAuthenticationPolicy`. We control storing the user id in the session in response to `LoginEvent` so there's no need to use a cookie. This way we also don't let horus save the user id but instead we save the "persona" which has the form "acct:<userid>@<provider>". This is the user id that the client sees and the user id that appears in `request.authenticated_userid`.
- The new package has an authentication policy that accepts `X-Annotator-Auth-Token` or an annotator token as an `Authorization: Bearer` token. This is for forward-compatibility when we migrate the client. The package has a token endpoint relies on the persona stored in the session from the login flow.
- The `h.api.lib` `Authenticator` now just uses the pyramid `request.authenticated_userid`. That means we still have some work to do to expand our API to support being our own OAuth Provider where the client id might not be the local one. That's fine for now, I just wanted to avoid depending on the consumer class in `h.api`.
- The notifier is no longer automatically included because it depends on the local auth models. We can look at ways to generalize it in the future, probably by migrating the DB so that it's no longer FK'd to the User table.