Refactor unittest/unittest2 imports to fix issues with unittest2 on py3.

Never use unittest2 on python 3 (it appears to not interoperate with
the standard unittest module).  On python 2, use the same logic in
tornado.testing and tornado.test.util to select an implementation.

Fixes #1005.
Update links for comments about json list output.

The vulnerability in the older link affects only ancient browsers,
but there are other issues that are more recent.

Fixes #1009.