Add some specificity on adder styles

Close #934
Close #1031
Better inject reset handling

This change pulls the nested-reset mixin into the annotator-frame class
and then increases the specificity of the rest of the styles underneath
the frame by giving them descendent selectors of the annotator-frame.

Additionally, to avoid interfering with site styles, our stylesheet of
resets (reset.scss) is no longer included in common.scss, but imported
directly under the annotator-frame class.

Fix #1366
Remove MANIFEST.in

Use setuptools_git instead when releasing.
Improve guard in form validate

I missed this in b67b2964b7a1fd1271be650ea02cf967fd0e17a3
Merge pull request #1372 from hypothesis/site-report-potpourri

Site report potpourri
Refactor and isolate identity, auth, and session

Introduce a new module on the frontend called `h.identity` which
abstracts the interaction between the main application and the
authentication system using the `navigator.id` API introduced by
Mozilla as part of Persona / BrowserID. In our case, the we submit
the authentication assertion as a query parameter in our token
URL. This is designed to flexibly accommodate different auth needs
by intepreting the assertion differently and using a different
identity module to return whatever type of grant is needed depending
on the authentication mechanisms in place on the back end.

On the back end:

- Introduce a dependency on a brand new library, pyramid-oauthlib, to
  make this code cleaner and more modular.
- Simplify our session by removing multiple signin code that was not
  ever fully realized; personas are no longer explicitly maintained in
  the session by application code.
- The Pyramid SessionAuthenticationPolicy is put into place as part of
  h.auth.local. A SessionGrant is configured as the default grant type
  for integration via pyramid-oauthlib. This is what interprets the
  assertion sent in our token request. For other use cases, this might
  be a real BrowserID assertion or a session or refresh token of some
  other kind. This assertion is just the CSRF token our forms have been
  returning already.
- `h#includeme` and `h#create_app` got some superficial simplification.
- `h.api#authorize` handler for annotator-store authorizations now uses
  `request.effective_principals` instead of the session, so it doesn't
  care how the user is authenticated
  - Headers are now passed through on `Store` sub-requests so that both
  the annotator auth token and the session work for store authorizations
  which gets us close to cookie-less API auth!
  - `Consumer` class is moved into `h.auth.local`, removing the SQL
  requirement for core `h` and replacing it with just the requirement to
  register an `IConsumer` implementer.

On the front end:

- Break hypothesis.js into hypothesis.js and hypothesis-auth.js
- Move session and auth modules into this auth package
- Clean up the module dependency imports
- Add an identity module to the auth package with `navigator.id` API
- Significantly refactor `AppController`
  - Use the `identity.watch()` API to listen to login/logout from the
  active identity module
  - Clean up the login/logout state management a bit
    - Resolve a promise when the API service discovery happens
    - Stop using 'session', which becomes a detail of hypothesis-auth
  - Put much less on the scope from the controller
    - `scope.initUpdater` -> `initUpdater`
    - `scope.reloadAnnotations` -> `initStore`
    - `scope.session` -> replaced by `id`
    - Sorts and views are set in the markup
    - `AuthController` no longers needs to know about `model`, `sheet`,
    `sorts` or `views`
  - Isolate the form models
    - The auth directive now creates an isolate scope so that we're not
    leaking the form models all over the place
    - Stop using the inherited `$scope.model` means prevents submitting
    `persona` as a form parameter by accident
- blocks.pt#auth-tabs becomes auth.html
  - Easy to override with `config.override_asset()` in Pyramid
  - Keeps the forms inside the isolate scope of the auth directive
- The content of the sheet moves inside blocks.pt#auth
  - Nothing outside this knows or cares anymore that the sheet has tabs
  - Places where we want to request login use `identity.request()`
  rather than having to get at the root scope. The `authorize` event
  that this broadcasts is an internal detail of the auth pacakage.
Merge pull request #1357 from hypothesis/identity-refactor

Refactoring identity and auth
Pyramid OAuthLib has been released
Pyramid Webassets has been released
Add YAML extra to bootstrap
Only copy private headers in API subrequests

This should include things like X-Client-Id, X-Forwarded-For,
X-Annotator-Auth-Token, etc, but not clobber Content-Length. Also,
copy the authorization header in case we start using that to convey
authorization.
Remove `hypothesis serve` command

Now ./run does the magic and delegates to gunicorn, exposing all
the options on the command line.

Close #1162
Remove some old bw-compat code
Use `request.domain` as the local auth provider

Rather than using `request.server_name`, which may or may not be
reliable, depending on the configuration, use the domain property
of the request which will be just the hostname part of the HTTP host
header with fallback to the server name.

Protect your production applications behind a trusted reverse proxy!

This is required after a behavior change with respect to the server
name in Gunicorn 19 but it also fixes the provider string on dokku.
All around I think it's less surprising.
Don't show "Sign in" until session settles
Remove the .content padding

Fix the accidental introduction of a discrepancy between the auth
sheet appearance and the other card appearances. This change also
slightly narrows the stream but it comes out looking solid so here's
hoping nobody minds.
Revive wordmark graphic and rename logo
Revert "Remove the .content padding"

This reverts commit 783d4eaee408662c620ad33b5519c3022f7a7774.
Less intrusive fix to accidental sheet padding
Update formValidate to use $setViewValue

This seems to be the correct way to interact with Angular views.