We need to fix `request.authority` in `h`

Pop quiz: What is the meaning of `request.authority` within the `h` app?

If you are like me, you'd intuit that it means "the authority for the current request" because it's attached to `request` in such a fashion.

Nope! Not at all! All it is is a static setting (or it falls back to the current domain if a setting isn't present for `authority`). So in `h`'s production case, it is _always_ `hypothes.is` (note: if you're running `h` locally, `request.authority` is `localhost` unless you override it).

There are two problems here:

1. This value doesn't do what it seems like it would, leading to me creating at least one bug in the past;
1. We _do_ have a need to know what the `authority` for the current request is (at least in the API), which is currently unmet

`request.authority` is used in 21 modules within `h`. Excising it will take some care.

One possible plan could be:

1) Rename current `request.authority` to `request.default_authority` or some other naming that more correctly implies what it is and that it is static. This could be a find-and-replace task for the most part
2) Re-implement `request.authority` such that it reflects the _request's authority_, that is, the default authority _or_ an authority applied to, say, an auth_client