Put like with like
Remove heatmap tab blinking and dead styles

I find the tab blinking to be too subtle to be meaningful and not
a worthy enough feature to justify more jQuery UI use or storing
an additional property on the annotation (see #1207).

If we want a feature like this we'll have to come back and revisit
it with a more critical eye.
Kill the card animation

It slows things down, especially on mobile devices and on the stream
where many annotations are loaded at once, and it doesn't add much
as it is.

Close #1119
Remove reply count from heatmap tabs
Remove now-dead code for reply counts in tabs

Another step toward #1207
More dead code around blinking buckets
Take applyUpdates off the scope

It's never called except within the AppController.
Like with like
Add some minor comments
Use 128bit crypto-random secret in default session

Much more sane than what I was doing. I was aiming for 128bits to suit
the default sha512 algorithm, but actually only got 64 and I should have
definitely used a source of secure randomness.
Don't log the whole email in the notifier

That's just crazy noisy. If email logs are desirable, they should
be configured in the mail server.
Gunicorn sets logging from paste by default now

Since 19.1
Disable the notifier by default

Until we can really polish its format.
Remove leftover line in karma config
128 BITS (not bytes)
One last time, changing the default secret size

So much misinformation around the net. I was first led to believe
by the WebOb documentation (through the Pyramid documentation) that
a secret of 128 bits was a good idea as it matches the internal
block size of the hash function.

The docs also say "64 characters". I don't know of any definition of
character that results in a 64 character string being 128 bits. Nor
is the block size of the default hash (SHA512) 128 bits; it is 1024.

Sigh.
Only set a session factory if none configured
Move janky csrf token stuff into auth.local
Fix csrf cookie subscriber for lesser dict-likes

Not all sessions support a length builtin on the session. For instance,
pyramid_redis_sessions does not. It is not formally part of the
:py:class:`pyramid.interfaces.IDict` interface either.
Add pyramid_redis_sessions to production config