static / media cleanup

- User uploaded files now are /media/
- Static files are now served from /static/ rather than / (django
  style).
Added session_security package