Remove obsolete code

onSetTool calls setVisibleHighlights so this is no longer needed.
Refactor back end authentication

Change the authentication to encapsulate it better within the h.auth
package, removing details from h.api and making more idiomatic use
of OAuthLib.

- Drop pyramid_multiauth and replace it with better considered use of
  pyramid_oauthlib.
  - Remove the need to list h in 'pyramid.includes'.
  - Stop the confusing double-use of 'request.user' by unsetting the
    horus property.
- Fill out the h.auth package.
  - The __init__.py has the configuration of the authn and authz
    policies.
  - The utils module holds helpers for constant-type string comparison,
    checking whether a client id refers to the browser application and
    fetching client credentials from the database.
  - The tokens module holds helpers for integrating with annotator.
  - The grant_types sub-package has a jwt_bearer module that implements
    draft-ietf-oauth-jwt-bearer.
- Support multiple storage consumers.
  - Treat clients and consumers as separate aspects of the request.
  - Set the 'consumer' property on requests inside the OAuthLib
    machinery.
  - Pass the consumer key to search operations so that consumers are
    isolated to a world with only their annotations.
  - The default consumer is the same as the API client and is the
    public instance of the annotation storage service.
  - All access tokens are issued by this API client.
  - Single Sign On consumers can use the JWT grant to override the
    consumer and gain access to their own, sandboxed storage.
  - Move remaining helpers out of h.api.
- Move session configuration to h.session.
- Start to fill out h.security with OAuth scope constants.