[WIP] Sticky privacy on the browser

Following @aron's idea I open this PR to get the best of both #1714 and #1716 

It does the following:
- The permission plugin no longer sets the permissions
- Because of this the read permission can be a one-item list for public annotations too: `["group:__world__"]` instead of `["group:__world__", <username>"`
- Privacy directive moved from `directives.coffee` to `directives/privacy.coffee`
- It uses the simple localStorage solution instead of angular-cache but not as a service, but as just some private functions for the privacy directive.

What is not nice:
- I've kept the visibility constants from the my branch but actually it looks rather stupid to store them in the localStorage and convert them to the appropriate privacy levels string
- I do not know how to get rid of the `privacy-default` variable. The directive does know nothing about the annotation and it is the only way to feed it with annotation data
- When we create a reply we have manually adjust its permissions, because there is no way inside the directive to read the parents permissions. Maybe, we could do this by including the annotator service inside the directive and use annotator.threading.getContainer .. something.. but that is overkill.

Questions:
- Was there any other reason to have the user in the `permissions.read` besides the permissions plugin?
- How can I reach the logged in user from the privacy directive? (Currently I'm just simply using annotation.user)

So thoughts are welcome. This is WIP, anything can change.
I don't understand your response, @aron. What I suggested is a map from constants to display values. It does keep what is in storage separate from what is displayed. But it also makes the mapping between them explicit in one place.

If this were ES6, we could even use its new features:

```coffee
levels =
    [VISIBILITY_PRIVATE]: 'Only Me'
    [VISIBILITY_PUBLIC]: 'Public'
```

All I'm suggesting is that, the literal string constants (not for display), 'public' and 'private' are as constant and clear as VISIBILITY_PUBLIC and VISIBILITY_PRIVATE, but that regardless the levels should probably be a map from the constant to the display value.