Sign session to prevent brute-forcing

This patch sign emitted cookies to prevent session brute-force.
It also refactor session interfaces to avoid code duplication (but do not modify exposed API or settings).
For the ease of testing external dependencies such as memcached or redis
are installed automatically using buildout.
When launching tests using make external services are also
started/stopped automatically.

I you have any suggestion / comments, feel free :)