actually use new tornado_settings

instead of deprecated webapp_settings

finishes #6491