Implementing in-house authentication

I have written all models, DB actions (delete) and views that fully implement the authentication system.
Since this is a major change in security (we expose a write access to our DB on the Internet), I ask you to review the changes thoroughly.

How does it work
============

Each user is identified by a unique username and a password. Passwords are stored as salted SHA512 hashes. We use the `passlib` Python library to handle that transparently.

Here is a query on my test DB:

    sqlite> select * from Users;
    test|$6$rounds=60000$mkstDqSFFT4rtk8R$awvaSa2yU0s/546kWiewri1SUklIh.HJtZT69LKOaDSkjIWbPWUGkdX/Ih.v.4.WHN0kMCSZkRZVZd0SuKgmE.

The username is base64 encoded and stored in a cookie with a timestamp and a HMAC (with SHA1, Python stdlib implementation, [documentation here](http://docs.python.org/2/library/hmac.html)) signature for integrity, like:

    usertoken="dGVzdA==|1382384756|a21d79cdae3270df508e7c085696c44692666a97"

which is, obviously, fictitious. The cookie max age can be configured and defaults to one day. The signature is calculated starting from cookie name, value, timestamp and a server secret, according to the standard procedure implemented by Tornado in `create_signed_value`, [source code here](http://www.tornadoweb.org/en/stable/_modules/tornado/web.html) 

How to protect a page
================

Authenticated path handlers must inherit from `bitsd.server.handlers.BaseHandler` and their `get`/`post` methods must be decorated with `tornado.web.authenticated`:

    class AwesomenessHandler(BaseHandler):
        @tornado.web.authenticated
        def get(self):
            # Something very exciting here...

That's it. Authentication and redirection to/from login page is handled behind the scenes for you :)

How to add/remove users
==================

Users can be added, removed or modified using `usermanage.py` utilty. It works more or less like `adduser` in interactive mode. It allows you to add:

    $ ./usermanage.py add test
    Password for `test`:

remove:

    $ ./usermanage.py delete test

and modify:

    $ ./usermanage.py modify test
    New password for `test`:

users in the database. This tool is still experimental: you don't risk compromising DB in any way or anything, but expect errors in non-ordinary cases (adding already existing users...). I will fix it asap, but it's not critical.

Important notice about security
======================

The authentication data is sent in clear text. It is **IMPERATIVE** to force SSL, at least on login page.