replace TG Visit/Identity framework with our own implementation using signed tokens

Change-Id: I7ecd872d21a4a5c2ee4ba17c3ce8c4ae2e5cd68b
wrap CherryPy in a Flask app

This patch also switches to use gunicorn instead of the built-in
CherryPy server for dev and tests.

Change-Id: I444ddbde2e26a0ff56da62ffac58c7ce7014262c
push up transaction handling to Flask instead of TurboGears

This way Flask request handlers get the same transaction management as
existing TurboGears controller methods.

Change-Id: I80ce5e5c2294f0d91477a343f31fc045b8aa4780
push up identity checking to Flask instead of CherryPy

Change-Id: Iddd946b96417fae05de4def93eb78442e1de9954