Only set a session factory if none configured
Move janky csrf token stuff into auth.local
Fix csrf cookie subscriber for lesser dict-likes

Not all sessions support a length builtin on the session. For instance,
pyramid_redis_sessions does not. It is not formally part of the
:py:class:`pyramid.interfaces.IDict` interface either.
Add pyramid_redis_sessions to production config
Allow overriding the session secret
Add the --log-config usage back

Until benoitc/gunicorn#845 is fixed we should explicitly configure
logging from our paste config.
Propagate gunicorn logs