Move x_frame_options out to gittip.security

This keeps configure-aspen.py a little less cluttered.
Trim horizontal space and suppress pyflakes msg
Moving response timing functions into a module
Start timing at the very beginning

We can do this now that we're not storing the start_time on the request
object. And we can do that now that we're using algorithm.py.