Add extra state property to Request

There is a requirement to store some state that is accessible from the
request at various times. This stores it in a single variable that is
well known so that hopefully it won't get clobbered.
Add new UserTickets database model

This is used for storing the currently logged in users various tickets.
Add a new AuthPolicy

This replaces the stock AuthTktAuthenticationPolicy with one that is
defined specifically for our app.
Use config.include('.security') for all security setup

This way our security sub-package is where everything is when it comes
to security, and we can be reasonable sure that everything the security
package requires is actually set up as required.
Make sure that state is added to Request in security

Since this is only used for security purposes we want to make sure that
it can't accidentally get missed.