Resurrect the removed visual diff support
Simplify/improve the visual diff

 * Move the calculations to the render funcion
 * Stop automatically `$sce.trust()`-ing the HTML code.
   (So now `$sanitize` is invoked automatically.)
   This also removes the need to use the `$sce` module,
   or to set the `trustedDIffHTML` flag, simplifying the code.
 * Use the `objectEquality` flag when `$watch()`ing the targets,
   so that we pick up changes in both the number and the contents
   of the targets
Stop overriding showDiff
Move showDiff from target level to annotation level.

Calculate the `showDiff` flag for the whole annotation,
instead of on a per-target basis.

Benefits:
 - One less variable stored inside the annotation model
 - We can more easily avoid unwanted overrides of the manually set value.
tabs -> spaces
Track diff per-target and set/unset showDiff
Avoid unnecessary annotation renders

The pattern of comparing the new value passed to a watcher with the old
value is idiomatic angular for avoiding the first digest. Instead, the
first digest is covered by the watch on the model reference identity.
After the initial rendering, the model will not change but the other
properties may, at which point re-rendering will occur.
Refactor to avoid renders and add tests

Rather than watching a bunch of subproperties, the most complex of
which are the targets, deep watch the whole annotation. The targets
were being deep watched already. This just seems much easier and
clearer than debouncing the render calls, and scales to whatever
properties much change in the future. We'll re-evaluate if this
becomes a bottleneck.
Digest upon store save confirmation
Add tests for annotation differences
Merge pull request #1709 from hypothesis/1238-restore-visual-diff

[WIP] Resurrect the removed visual diff support
Update timestamps of annotations upon render

Move the updateTimestamp function into the controller and call it
when render is called. If it is the first time, invoke it with a
flag that causes it to call itself, otherwise it will only update
once.
Add tests for annotation timestamp updates
Incorporate review feedback on annotation

- Fix a typo where a closure was unbound
- Always set target.hasDiff rather than having it be sometimes
  undefined and sometimes true.

Thanks @aron
Refactor back end authentication

Change the authentication to encapsulate it better within the h.auth
package, removing details from h.api and making more idiomatic use
of OAuthLib.

- Drop pyramid_multiauth and replace it with better considered use of
  pyramid_oauthlib.
  - Remove the need to list h in 'pyramid.includes'.
  - Stop the confusing double-use of 'request.user' by unsetting the
    horus property.
- Fill out the h.auth package.
  - The __init__.py has the configuration of the authn and authz
    policies.
  - The utils module holds helpers for constant-type string comparison,
    checking whether a client id refers to the browser application and
    fetching client credentials from the database.
  - The tokens module holds helpers for integrating with annotator.
  - The grant_types sub-package has a jwt_bearer module that implements
    draft-ietf-oauth-jwt-bearer.
- Support multiple storage consumers.
  - Treat clients and consumers as separate aspects of the request.
  - Set the 'consumer' property on requests inside the OAuthLib
    machinery.
  - Pass the consumer key to search operations so that consumers are
    isolated to a world with only their annotations.
  - The default consumer is the same as the API client and is the
    public instance of the annotation storage service.
  - All access tokens are issued by this API client.
  - Single Sign On consumers can use the JWT grant to override the
    consumer and gain access to their own, sandboxed storage.
  - Move remaining helpers out of h.api.
- Move session configuration to h.session.
- Start to fill out h.security with OAuth scope constants.