Pyramid OAuthLib has been released
Pyramid Webassets has been released
Add YAML extra to bootstrap
Only copy private headers in API subrequests

This should include things like X-Client-Id, X-Forwarded-For,
X-Annotator-Auth-Token, etc, but not clobber Content-Length. Also,
copy the authorization header in case we start using that to convey
authorization.
Remove `hypothesis serve` command

Now ./run does the magic and delegates to gunicorn, exposing all
the options on the command line.

Close #1162
Remove some old bw-compat code
Use `request.domain` as the local auth provider

Rather than using `request.server_name`, which may or may not be
reliable, depending on the configuration, use the domain property
of the request which will be just the hostname part of the HTTP host
header with fallback to the server name.

Protect your production applications behind a trusted reverse proxy!

This is required after a behavior change with respect to the server
name in Gunicorn 19 but it also fixes the provider string on dokku.
All around I think it's less surprising.
Don't show "Sign in" until session settles
Remove the .content padding

Fix the accidental introduction of a discrepancy between the auth
sheet appearance and the other card appearances. This change also
slightly narrows the stream but it comes out looking solid so here's
hoping nobody minds.
Revive wordmark graphic and rename logo
Revert "Remove the .content padding"

This reverts commit 783d4eaee408662c620ad33b5519c3022f7a7774.
Less intrusive fix to accidental sheet padding
Simplify notifier
Remove customsearch templates