test_requirements.txt: Float Tornado up to (but not including) 4.0

The current Tornado version is 4.0.2 (released 2014-09-11).  Instead
of being very conservative here, assume Tornado uses semantic
versioning [2] and would have bumped to 4.x earlier if they broke
backwards compatibility.  Folks who are skeptical of their local
Tornado can use the test suite to verify it, and we can blacklist any
versions that we know are bad.

It's possible that Thumbor's tests are compatible with the Tornado 4.x
API.  I haven't audited the tests to see what we use, or read over
Tornado's 4.0 release notes to see what changed.  If someone has time
to do that, and we're still compatible, I'd suggest making the upper
limit < 5.0.0.

[1]: https://pypi.python.org/pypi/tornado/4.0.2
[2]: http://semver.org/