enable cross-site reference forgery
check string type for both python 2 & 3
add cookie_secret for tornado, and remove random string from github
user tasks
shorten miitus.defs
default include all task modules

- other dependecies rely on miitus.config.CELERY_MODULES_INCLUDE
'_2PATCH_' would be totally removed.
move module-import from core to config

the task modules passed via include parameter of celery.__init__
doesn't work. Now we pass it via CELERY_IMPORT config opiton.
perform db management task before running web server
handle the mass of celery config option

some celery option would be prefixed with 'CELERY' and other are not.
- now those config imported via celery.config_from_object would be
prefixed with 'CELERY_CONF_'
add rest status code
rename util to utils
rename err to exceptions
implement user-object loader function
make max_age(for cookie) configurable

- also enable 'chord exception propagate'
oops, it's not what I want
pop password before sending it
let Model can expose dict

actually now we can use _as_dict directly, just in case it become
private in the future.
also init token when login
add exception for wrong-password