Change annotation create response to 201

With the URL to read the annotation in a Location header
Send 403 when authenticated but not authorized
Merge pull request #96 from seanh/63-improve-response-codes-and-headers

#63 improve response codes and headers
search: Allow searching over empty indices

We must specify 'allow_unmapped' in the sort directives for these
queries, because otherwise elasticsearch will claim the fields are
unmapped when the indices are empty -- even if the mapping contains
entries for the 'updated' field.
tox: Fix tox config typo introduced by 0176afd0
dist: Add manifest file

We need CHANGES.rst to be included in the distribution otherwise
setup.py will bomb.
tests: Install testing deps with tox