Move /api/search -> /api/annotations

These are saner semantics. The index should be the index, and accept
queries. There is no need for an explicit search endpoint.
Allow data: URIs for fonts in Chrome CSP
Load pyramid_multiauth before pyramid_basemodel

Here's a thing I think I broke somehow with recent commits shuffling
about the __init__.py and app.py modules.

We must make sure pyramid_basemodel is loaded after the modules that
set up the models.

In our case, the local auth models need to be loaded.