Sticky privacy on the browser

- The permission plugin no longer sets the permissions
- Read permission is a one-item list ["group:__world__"] instead of ["group:__world__", <username>"]
- Privacy directive moved to directives/privacy.coffee
- Uses the simple localStorage solution inside the privacy directive.
Get rid of privacy-default
Tests for privacy directive
Fill highlight's permissions
Use an object to for privacy level models

This makes the association between the level key name and the display
text explicit and tight in the code.
Merge pull request #1741 from hypothesis/sticky-visibility-level-object

Use an object for privacy level models
Merge pull request #1727 from hypothesis/sticky-visibility-setting-alt-2

Sticky privacy on the browser