Implement delete_dir in the FileStorage

plus options for deleting only empty directories and deleting
them recursively.

Not sure how cloudfile storage is or should be handled here. Are
things such as a "directory" even a concept there?
Convert media processing backends to delete the queue directory (#254)

We never deleted our queue directory which were created per submission.
With the FileStorage backend being able to delete directories now, we can
request the deletion of the task directory too. It will only be deleted if
it is completely empty.
Removing docstring bit about delete_file possibly deleting directories in the future

I agree that delete_dir as a separate operation is a better way to do
things, especially since there is a non-recursive deletion option that
will politely fail if the directory is not empty.
Basic itsdangerous infrastructure.

Implement the basic infrastructure for using itsdangerous
in mediagoblin. Usage instructions will follow.
Docs for get_timed_signer_url.
Improve fs security for itsdangerous secret.

Set mode 700 on the directory, mode 600 on the file.
Back sessions with It's Dangerous.

This is a contribution to #668.
Delete the session cookie on an empty session.
Remove beaker stuff from the code.

This is all obsoleted by It's Dangerous.
Set a starting value for session.send_new_cookie.

This makes session.__init__ slightly more complicated but probably
simplifies everything else, especially if we make the class smarter
later by having it track changes itself.
First tests for the Session class.
Harden It's Dangerous key management.

The previous code was theoretically subject to timing attacks, where
an attacker could read the key in between the time it was saved to the
file and when the chmod happened.  This version prevents that by using
umasks to ensure the files always have the right permissions.

This version also avoids using a key that cannot be saved due to some
system setup bug.
Call is_updated instead of testing it boolean.
Refactor generate_slug into a mixin.

Refactor the new generate_slug into a mixin to
allow it to be used for collections also.
Use GenerateSlugMixin for collections.

Use the new way of generating slugs also for collections.
Also drop the dummy_db arg to check_collection_slug_used.
Better docs for GenerateSlugMixin.
Really removing nosetests things now!  all assert_whatever removed
OAuth: Support refresh tokens, etc

Initially I was going to write a failing test for refresh tokens. Thus
this fix includes an orphaned 'expect_failure' method in test utils.

I ended up writing support for OAuth refresh tokens, as well as a lot of
cleanup (hopefully) in the OAuth plugin code.

**Rebase**: While waiting for this stuff to be merged, the testing
framework changed, it comes with batteries included regarding fails.
Removed legacy nosetest helper.

Also added a lot of backref=backref([...], cascade='all, delete-orphan')
Teach runtests.sh the -n arg.

If you give "-n 8" to runtests, it thinks, it got
"-n" -- a nice option, ignored.
"8"  -- Oh! a single test named "8" to run, so no need to
        run all the GMG tests.

Well, that's not what we want. So runtests now knows about
-n taking an arg.
Convenience functions for callable hooks