Update notes for submitted changes

* push up identity checking to Flask instead of CherryPy
* push up transaction handling to Flask instead of TurboGears
* wrap CherryPy in a Flask app
* replace TG Visit/Identity framework with our own implementation using signed tokens