actually use tornado_settings

instead of deprecated webapp_settings

finishes #6491