Bump Tornado requirement to >= 2.3.0, < 4.0.0

This is like #370, but for Tornado instead of Pillow.  It's also based
on #369, so you probably want to merge/reject that first.