[Fix bug 966740] Upgrade tastypie.

* Remove hardcoded tastypie directory under vendor-local/lib/python
* Add tastypie as a submodule
* Fix XSS in /api
* Upgrade tastypie to latest release v0.9.15