replace unneccessary "bad prng" for display_id

This was an artifact from the original codebase, which deterministically
generated a journalist's codename for each source by seeding a PRNG (not
CSPRNG) with the sid. We no longer need to do this because we associate sid's
with the journalist interface codenames in the db.
Use declarative ORM instead of using the engine directly

This makes the code easier to read, understand, and extend, and reduces the
requisite boilerplate.

Also moves the handling of the session into the request methods, which is
recommended [0].

[0] http://docs.sqlalchemy.org/en/rel_0_9/orm/session.html?highlight=scoped_session#when-do-i-construct-a-session-when-do-i-commit-it-and-when-do-i-close-it
flag sources in the db
encapsulate source lookup and error handling
DRY out common "get sid, then source" pattern with g
Merge branch 'develop' into db-rewrite

Conflicts:
	securedrop/tests/unit_tests.py
s/db.create_tables/db.init_db
Fix broken metadata unit tests

These tests were unnecessarily calling _new_codename twice, and there appears
to have been a bad interaction between that and the new "get source" logic in
setup_g. Possibly related to the "back button"/session clearing bug (#294).
Fix MAT dependencies in .travis.yml
Merge pull request #330 from garrettr/db-rewrite

db rewrite