[WIP] Scope database sessions to API requests.

WIP fix for #84.  The basic idea is to lazily create session objects for each HTTP Request, cleaning them up during the request's `finish` method, with some extra wrinkles thrown in because some of the Hub's management routines also make database queries, and these have less obvious natural scopes than HTTP Requests.

There are a few issues with this strategy that I'm not sure how to solve:

1. When a database object is queried in a new session, it loses any Python-only attributes that have been tacked onto it.  This means, in particular, that the spawner column on User doesn't persist between requests (the lone remaining test failure is caused by this).  I'm not sure whether it's important to persist the Python-level spawner.  If it is important, I'm not sure whether it could be straightforwardly persisted in the database.

2. Making this work with the Hub's management routines is pretty awkward.  In particular, there's a lot of manual moving of the Proxy between database sessions, and there's at least one location where I'm nesting calls to `new_db_session`.  I could probably deal with the latter by making `new_db_session` idempotent.