Stop using Tornado 4.5.3

Tornado 4.5.3 is over 7 years old. We can't keep using it forever.

See also: #991

From what I understood, there are two problems:

• Tornado 5.0 started using asyncio internally.
• Tornado 6.0 entirely removed WSGI support.

gevent doesn't play nice with asyncio by default. There are some snippets on the internet that attempt to integrate gevent's and asyncio's event loops, but none of them look particularly well-maintained to me (but they aren't very big, so we would probably end up copy-pasting one and maintaining it ourselves).

Replacing gevent with asyncio would probably be quite a big project: we need to add async/await everywhere, and we need to improve test coverage to make sure we don't forget any awaits.

So we have a few options:

• Upgrade Tornado, rewrite all our WSGI middlewares, replace gevent with asyncio.
• Upgrade Tornado, rewrite all our WSGI middlewares, implement a compatibility hack to use gevent and asyncio together.
• Replace Tornado with some other WSGI-friendly framework, rewrite all of our request-handling. (Optionally we can still replace gevent with asyncio later.)

Personally, I have a mild distaste for gevent in general, and would prefer replacing it with asyncio. I don't have much experience with other web frameworks so I don't know much about tornado vs other possible web frameworks. At a glance, our WSGI middlewares all look like things that could be implemented using regular Tornado request handlers, but maybe I missed some complications.

Start by reviewing the WSGI middlewares and request-handling code, then read the discussion in #991. Compare the Tornado, gevent, and asyncio constraints described here and inspect existing test coverage. Done requires choosing and implementing a migration path away from Tornado 4.5.3, with middleware and asynchronous behavior covered by tests.