Clear XSRF-TOKEN cookie on invalidation
Remove redundant default response headers
userName -> persona filter and parameterization

Make the userName filter more useful by expanding it to a general
parameterized persona filter.
Remove unused userString Auth plugin option
Consistent use of interfaces and db sessions

Improve the consistency of access patterns for database sessions
by using interfaces everywhere.

- Use IDBSession in Consumer.get_by_key via hem.db.get_session. This
  way our mixins can be used without pyramid_basemodel, just as horus
  can.
- Use IConsumerClass and IAnnotationClass in the annotator-store
  integration.
Simplify plugin resets on persona change