Link to install instructions for ICU Analysis plugin
Refactor back end authentication

Change the authentication to encapsulate it better within the h.auth
package, removing details from h.api and making more idiomatic use
of OAuthLib.

- Move ``h.auth.local`` to ``h.accounts``.
- Move ``h.auth`` to ``h.oauth``.
- Move ``h.interfaces.IConsumerClass`` to ``h.oauth``.
- Drop pyramid_multiauth and replace it with better considered use of
  pyramid_oauthlib.
  - Stop the confusing double-use of 'request.user' by unsetting the
    request property set by horus.
- Fill out the h.auth package.
  - The package configures the authn and authz policies.
  - The lib module holds helpers for constant-type string comparison,
    checking whether a client id refers to the web application and
    fetching client credentials from the database.
  - The tokens module holds helpers for integrating with Annotator.
- Rework consumers.
  - Rename Consumer to Client everywhere but the annotator integration.
  - Make the ``auth`` package responsible for the web client
    credentials, now provided by the settings ``h.auth.client_id`` and
    ``h.auth.client_secret``.
  - Clients can supply their credentials on requests and the client
    credentials grant now works to get an access token, though it does
    not include any authorizations yet.
- Move session configuration to h.session.