Links to annotations made in EPUBS fail in Safari/Firefox

## Related

### EPUBS

Related to https://github.com/hypothesis/product-backlog/issues/1356

Related to https://github.com/hypothesis/product-backlog/issues/709

### PDFs

Related to #1358

Related to https://github.com/hypothesis/product-backlog/issues/1360

### Steps to reproduce
1. Make an annotation in an epub (eg, [using the Hypothesis EPUB demos](https://web.hypothes.is/demos/)).
2. Using Safari or Firefox, navigate to any link provided by the annotation to return to the document (eg, the sharing link on the annotation, the view in context link in activity pages/search, etc).
3. See the annotation bar load, but not the EPUB. Errors below.

### Expected behaviour
When I click on a link to see an annotation in context, I should be taken to view that annotation in context in the EPUB in which it was made.

### Browser/system information
Mac OS 10.13.5. Chrome Version 67.0.3396.99 (Official Build) (64-bit). Safari Version 11.1.1 (13605.2.8). Firefox 61.0.1 (64-bit).

### Actual behaviour
[Annotation made using Readium](https://hypothes.is/a/1Pw_FIRiEeioGdufuKnQ-g):
* Annotation share link: https://hyp.is/1Pw_FIRiEeioGdufuKnQ-g/cdn.hypothes.is/demos/epub/readium-js/index.html?epub=%2Fdemos%2Fepub%2Fcontent%2Fmoby-dick%2Fbook.epub&epubs=%2Fdemos%2Fepub%2Fcontent%2Flibrary.json&goto=%7B%22idref%22%3A%22xchapter_003%22%2C%22elementCfi%22%3A%22%2F4%2F2%2F2%2F2%2F1%3A0%22%7D&
* Annotation visit annotation in context link: https://hyp.is/1Pw_FIRiEeioGdufuKnQ-g/cdn.hypothes.is/demos/epub/readium-js/index.html?epub=%2Fdemos%2Fepub%2Fcontent%2Fmoby-dick%2Fbook.epub&epubs=%2Fdemos%2Fepub%2Fcontent%2Flibrary.json&goto=%7B%22idref%22%3A%22xchapter_003%22%2C%22elementCfi%22%3A%22%2F4%2F2%2F2%2F2%2F1%3A0%22%7D&
* Activity page visit annotations in context link: https://hyp.is/1Pw_FIRiEeioGdufuKnQ-g/cdn.hypothes.is/demos/epub/readium-js/index.html?epub=%2Fdemos%2Fepub%2Fcontent%2Fmoby-dick%2Fbook.epub&epubs=%2Fdemos%2Fepub%2Fcontent%2Flibrary.json&goto=%7B%22idref%22%3A%22xchapter_003%22%2C%22elementCfi%22%3A%22%2F4%2F2%2F2%2F2%2F1%3A0%22%7D&
* Works: In Chrome, these links resolve to:
* Doesn't work: In Firefox and Safari, these links resolve to: https://via.hypothes.is/https://cdn.hypothes.is/demos/epub/readium-js/index.html?epub=%2Fdemos%2Fepub%2Fcontent%2Fmoby-dick%2Fbook.epub&epubs=%2Fdemos%2Fepub%2Fcontent%2Flibrary.json&goto=%7B%22idref%22%3A%22xchapter_003%22%2C%22elementCfi%22%3A%22%2F4%2F2%2F2%2F2%2F1%3A0%22%7D&#annotations:1Pw_FIRiEeioGdufuKnQ-g
* Safari errors:
```
[Error] Failed to load resource: the server responded with a status of 403 () (readium-js-viewer_all.js.map, line 0)
[Error] SecurityError: Blocked attempt to use history.replaceState() to change session history URL from https://via.hypothes.is/https://cdn.hypothes.is/demos/epub/readium-js/index.html?epub=%2Fdemos%2Fepub%2Fcontent%2Fmoby-dick%2Fbook.epub&epubs=%2Fdemos%2Fepub%2Fcontent%2Flibrary.json&goto=%7B%22idref%22%3A%22xchapter_003%22%2C%22elementCfi%22%3A%22%2F4%2F2%2F2%2F2%2F1%3A0%22%7D&#annotations:1Pw_FIRiEeioGdufuKnQ-g to https://cdn.hypothes.is/demos/epub/readium-js/index.html?epub=%2Fdemos%2Fepub%2Fcontent%2Fmoby-dick%2Fbook.epub&epubs=%2Fdemos%2Fepub%2Fcontent%2Flibrary.json&goto=%7B%22idref%22%3A%22xchapter_003%22%2C%22elementCfi%22%3A%22%2F4%2F2%2F2%2F2%2F1%3A0%22%7D&. Protocols, domains, ports, usernames, and passwords must match.
replaceState (wombat.js:699)
rewritten_func (wombat.js:699)
l (readium-js-viewer_all.js:27:30868)
(anonymous function) (readium-js-viewer_all.js:27:31439)
dispatch (readium-js-viewer_all.js:2:29418)
handle (readium-js-viewer_all.js:2:27483)
trigger (readium-js-viewer_all.js:3:19855)
triggerHandler (readium-js-viewer_all.js:3:20463)
a (readium-js-viewer_all.js:27:30096)
c (readium-js-viewer_all.js:2:19164)
add (readium-js-viewer_all.js:2:19457)
ready (readium-js-viewer_all.js:2:21543)
init (readium-js-viewer_all.js:2:17054)
re (readium-js-viewer_all.js:1:25023)
(anonymous function) (readium-js-viewer_all.js:28:840)
d (readium-js-viewer_all.js:1:2234)
a (readium-js-viewer_all.js:1:1055)
d (readium-js-viewer_all.js:1:2133)
(anonymous function) (readium-js-viewer_all.js:1:2622)
[Error] Error: See almond README: incorrect module build, no module name
define (readium-js-viewer_all.js:1:2815)
(anonymous function) (annotator.bundle.js:20)
(anonymous function) (annotator.bundle.js:20:238)
o (annotator.bundle.js:1:270)
(anonymous function) (annotator.bundle.js:1:318)
(anonymous function) (annotator.bundle.js:131:2440)
o (annotator.bundle.js:1:270)
(anonymous function) (annotator.bundle.js:1:318)
(anonymous function) (annotator.bundle.js:122:97)
o (annotator.bundle.js:1:270)
(anonymous function) (annotator.bundle.js:1:318)
(anonymous function) (annotator.bundle.js:167:2593)
(anonymous function) (annotator.bundle.js:167:11845)
o (annotator.bundle.js:1:270)
(anonymous function) (annotator.bundle.js:1:318)
(anonymous function) (annotator.bundle.js:182:227)
o (annotator.bundle.js:1:270)
r (annotator.bundle.js:1:433)
Global Code (annotator.bundle.js:1:461)
```
* Firefox errors:
```
[Show/hide message details.] SecurityError: The operation is insecure. wombat.js:699
rewritten_func
https://via.hypothes.is/static/__pywb/wombat.js:699:13
l
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:27:30847

https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:27:31432
dispatch
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:2:29359
add/m.handle
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:2:27459
trigger
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:3:19847
triggerHandler
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:3:20446
a
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:27:30071
c
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:2:19153
fireWith
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:2:19921
ready
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:2:21735
a
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:1:13746
[Show/hide message details.] Error: See almond README: incorrect module build, no module name readium-js-viewer_all.js:1:2744
define
https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js:1:2744
[6]
_prelude.js:1
Source map error: request failed with status 403
Resource URL: https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/readium-js/scripts/readium-js-viewer_all.js
Source Map URL: readium-js-viewer_all.js.map[Learn More]
```

[Annotation made using epub.js](https://hypothes.is/a/1wi-AIRmEeitfUfgi7ROIQ):
* Annotation share link: https://hyp.is/1wi-AIRmEeitfUfgi7ROIQ/cdn.hypothes.is/demos/epub/epub.js/index.html?loc=chapter_003.xhtml
* Annotation visit annotation in context link: https://hyp.is/1wi-AIRmEeitfUfgi7ROIQ/cdn.hypothes.is/demos/epub/epub.js/index.html?loc=chapter_003.xhtml
* Activity page visit annotations in context link: Because these annotations made in two different readers were made on the same EPUB, the Activity page link for both annotations is the Readium link above.
* Works: In Chrome, these links resolve to https://cdn.hypothes.is/demos/epub/epub.js/index.html?loc=chapter_003.xhtml
* Doesn't work: In Firefox and Safari, these links resolve to https://via.hypothes.is/https://cdn.hypothes.is/demos/epub/epub.js/index.html?loc=chapter_003.xhtml#annotations:1wi-AIRmEeitfUfgi7ROIQ
* Safari errors:
```
[Error] Object

message: "File not found in the epub: http://fonts/STIXGeneral.otf"

stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:13206…"

Object Prototype

(anonymous function) (epub.min.js:1:109681)
promiseReactionJob
[Error] {message: "File not found in the epub: http://fonts/STIXGeneralItalic.otf", stack: "value@https://via.hypothes.is/js_/https://cdn.hypo…b.min.js:1:83907↵promiseReactionJob@[native code]"}
(anonymous function) (epub.min.js:1:109681)
promiseReactionJob
[Error] {message: "File not found in the epub: http://fonts/STIXGeneralBol.otf", stack: "value@https://via.hypothes.is/js_/https://cdn.hypo…b.min.js:1:83907↵promiseReactionJob@[native code]"}
(anonymous function) (epub.min.js:1:109681)
promiseReactionJob
[Error] {message: "File not found in the epub: http://fonts/STIXGeneralBolIta.otf", stack: "value@https://via.hypothes.is/js_/https://cdn.hypo…b.min.js:1:83907↵promiseReactionJob@[native code]"}
(anonymous function) (epub.min.js:1:109681)
promiseReactionJob
[Error] {message: "File not found in the epub: http://images/9780316000000.jpg", stack: "value@https://via.hypothes.is/js_/https://cdn.hypo…b.min.js:1:83907↵promiseReactionJob@[native code]"}
(anonymous function) (epub.min.js:1:109681)
promiseReactionJob
[Error] {message: "File not found in the epub: http://css/stylesheet.css", stack: "value@https://via.hypothes.is/js_/https://cdn.hypo…b.min.js:1:83907↵promiseReactionJob@[native code]"}
(anonymous function) (epub.min.js:1:109681)
promiseReactionJob
[Error] {message: "File not found in the epub: http://images/Moby-Dick_FE_title_page.jpg", stack: "value@https://via.hypothes.is/js_/https://cdn.hypo…b.min.js:1:83907↵promiseReactionJob@[native code]"}
(anonymous function) (epub.min.js:1:109681)
promiseReactionJob
[Error] Unhandled Promise Rejection: [object Object]
(anonymous function)
promiseReactionJob
[Error] Unhandled Promise Rejection: Error: No Section Found
(anonymous function)
rejectPromise
(anonymous function) (epub.min.js:1:33267)
(anonymous function)
promiseReactionJob
```
* Firefox errors:
```
Object { message: "File not found in the epub: http://fonts/STIXGeneral.otf", stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:132056\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109081\nvalue/t<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109627\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109565\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:85149\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:83890\nvalue/<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:82003\n" }
epub.min.js:1:109667
Object { message: "File not found in the epub: http://fonts/STIXGeneralItalic.otf", stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:132056\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109081\nvalue/t<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109627\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109565\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:85149\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:83890\nvalue/<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:82003\n" }
epub.min.js:1:109667
Object { message: "File not found in the epub: http://fonts/STIXGeneralBol.otf", stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:132056\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109081\nvalue/t<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109627\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109565\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:85149\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:83890\nvalue/<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:82003\n" }
epub.min.js:1:109667
Object { message: "File not found in the epub: http://fonts/STIXGeneralBolIta.otf", stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:132056\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109081\nvalue/t<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109627\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109565\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:85149\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:83890\nvalue/<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:82003\n" }
epub.min.js:1:109667
Object { message: "File not found in the epub: http://images/9780316000000.jpg", stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:132056\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109081\nvalue/t<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109627\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109565\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:85149\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:83890\nvalue/<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:82003\n" }
epub.min.js:1:109667
Object { message: "File not found in the epub: http://css/stylesheet.css", stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:132056\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109081\nvalue/t<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109627\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109565\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:85149\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:83890\nvalue/<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:82003\n" }
epub.min.js:1:109667
Object { message: "File not found in the epub: http://images/Moby-Dick_FE_title_page.jpg", stack: "value@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:132056\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109081\nvalue/t<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109627\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:109565\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:85149\nvalue@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:83890\nvalue/<@https://via.hypothes.is/js_/https://cdn.hypothes.is/demos/epub/epub.js/node_modules/epubjs/dist/epub.min.js:1:82003\n" }
epub.min.js:1:109667
Error: No Section Found epub.min.js:1:60595
Loading failed for the with source “https://www.google-analytics.com/analytics.js”. app.html:1
looked up unknown feature overlay_highlighter features.js:24:6
```

Reproduce the annotation links in Safari and Firefox using the Readium and epub.js EPUB demos. Start by examining the reported failures in readium-js-viewer_all.js, epub.min.js, annotator.bundle.js, and via.hypothes.is, then verify that shared and activity-page links load the EPUB and open the annotation in context.

Written by the indexing model from the issue text.