Return permissions for anonymous user, too

So far no permissions were returned when calling /permissions if one was not
logged in. This behavior is changed with this commit. One can assign permissions
for the anonymous user, so there is no reason why a front-end shouldn't be able
to ask for them.
Require only browse permissions for several APIs

This commit makes annotation_list, compact_skeleton and compact_arbot APIs
accessible for users with only browse permissions.
Raise an error if no skeleton IDs are provided in annotation_list API
Be more fault tolerant in checkPermissions on client side

Even with a non-existing permission this method shouldn't fail.
Remove some unneeded whitespace
Notifications: make list API require only can_browse permissions

This API only retrieves information linked to the requesting user and does't
change data. It therefore should be possible to access it with 'can_browse'
permissions. Also, this change makes it easier for the front end, because it
doesn't need to check permissions before opening the notifications widget.
Skeleton analytics: raise error if skeleton IDs are missing
Tests: add basic anonymous access test

The test currently case currently checks a very small set of API calls. This
will be extended over time.
Skeleton analytics: require only 'can_browse' permissions
Skeleton analytics: use jsonResponseHandler for update query

This is done to reuse the error checking done in the handler code.
Connector module: raise error on missing parameters in one_to_many_synapses
Graph module: raise errors if there are parameters missing
Annotations: require can_annotate role for new annotations

Before one needed either can_annotate or can_browse. This commit
changes this to require only can_annotate.
Fix some whitespace errors [minor]
Add convenience function to show error dialog
Annotations: check permissions before displaying dialog
Annotations: show error dialog if no annotation target is selected

This replaces the use of alert() at this place.
Make anonymous user distinguishable from Django's AnonymousUser

Django uses a special object---the AnonymousUser---for requests that are not
bound to a logged in user. Since we use guardian we replace this object with an
actual user object (with the ID set in ANONYMOUS_USER_ID, usually -1) in a
middleware class. So far this user had its is_anonymous() function set to return
False. This however imposes a problem if one wants to have permissions for this
users (e.g. testing them with user.has_perm()). As it turns out, permissions are
not checked if is_anonymous() returns True. The Django documentation says this
method is only used to distinguish real user objects from the AnonymousUser
object. Our anonymous user is a real user and therefore this commit changes this
function of the anonymous user to return False.
Allow user list retrival also for not logged in users with can_browse permission

This allows also for setups where the anonymous user (i.e. not logged in user)
can access this information if it was given the can_browse permission.
Fix whitespace in some files [minor]