Update list of templates that are excluded from extraction of strings for translation.
Update repoze.who to 2.1.

Allows auth_tkt cookie to be flagged as secure (httponly and ssl only).