Only login if not already authenticated

Calling login here calls identity.request to be called, which in turn
eventually results in the onlogin callback running.

The onlogin callback is not currently idempotent (and it isn't trivial
to make it so) so this results in errors being thrown by Annotator.

Fixes #1611.
tests/js: Normalise controller namespace and names

These names were updated in scripts/controllers.coffee but not here.
Add a config.js file to the Chrome extension

This allows the Chrome extension to be configured with hypothesisConfig.
Also moved this file and the destroy.js file into an extension
subdirectory to avoid confusion with the main app files.
Show highlights when showHighlights option is provided
Add unit tests to verify showHighlights option
Include the hypothesisConfig in the bookmarklet
Use a meta tag to signify a first run

This allows the page to notify the chrome extension via an "intent"
meta tag that the sidebar should launch in first run mode.
Handle login validation in colander

This is a step toward weaning off the horus views.

Close #1660
Show form wide responses only when message exists

The $error key for the form will have an Array of the errors of its
fields for that key. That means that a bad password response causes
the entire login form to have a truthy $error.response value. That's
not wrong, and we could be using it to show all the errors in a block
at the top of the form, but it's not how we want to use it for this
case.
Merge pull request #1640 from hypothesis/1611-fix-double-login

Only login if not already authenticated
Merge pull request #1626 from hypothesis/show-highlights-by-default

Show highlights by default in the Chrome Extension
Fixed z-index sidebar at max

Close #1679
Consistency
Merge pull request #1669 from hypothesis/1660-activation-error-reporting

Handle login validation in colander
tests: Remove unused functional tests

These are currently being ignored. This commit removes them from the
repository.
Merge pull request #1681 from hypothesis/remove-functional-tests

Remove unused functional tests
api: Use the string versions of the client secret

This is ugly, but because Consumer#secret is a UUID, we should be using
the Consumer#client_secret property here which is a string (unicode)
representation of the secret.

The prior state causes 500s on the token endpoint on a fresh checkout.

This commit also adds a test suite for h.api.Token