There is a breaking change in gunicorn 19 which changes
the behavior of the `REMOTE_ADDR` request meta info. It
no longer correctly passes through the value of X-Forwarded-For
if that header is present.

This resulted in making anything that looked at this attribute
think that all requests were coming from 127.0.0.1

This broke the django-ratelimit-backend library which relies on
this feature to determine if a user has had too many login attempts.

Gunicorn Change Log: http://docs.gunicorn.org/en/stable/2015-news.html

There are issues in the newest version that we don't want to pick up yet.

We're quite far behind, let's start by just looking at the treadmill.

PLAT-2254

There was an issue with migrations on sandboxes.

This reverts commit 58f6e925

Tornado Changelog: http://www.tornadoweb.org/en/stable/releases/v5.1.0.html

the plugin has abandonned support for python 2 so functionality is not
guaranteed in future upgrades.

Django 1.11 Changelog - https://docs.djangoproject.com/en/2.0/releases/1.11.14/