Enforce namespace restrictions

[MarcusBarnes]

Currently, the annotation UI does not handle Islandora's Enforce namespace restrictions namespace configuration setting. This would be a potentially useful enhancement when having multiple Drupal instances pointing to the same Fedora commons instance.

[MarcusBarnes]

Possibly related to #179.

[kstapelfeldt]

As a user, I expect that when namespace restrictions are applied to a site, I will bring back only annotations with allowed namespaces. We are not sure if this is currently how the software functions. This needs to be tested. We should explore in a multisite and singlesite environment.

Singlesite test: Create a namespace for annotations, create annotations under this namespace, enforce namespace restrictions in Islandora setting, disallowing the annotation namespace, search for a created annotation and see if it is returned.

Also: Return to the annotated object, and see if the object annotation under the restricted namespace appears.

Also: Author XACML policies on the annotation collection and see if these are respected in search and the UI

[kstapelfeldt]

With the new collection for annotations, we may have another method available for restricting namespaces.