Marcidy/nonce refactor

[marcidy]

refactored the nonce stuff so it's smaller impact on routes.py.

added the following:

creating of a 32character nonce
store to database object (WARNING: this needs a db migrate. I'll do it, just pointing it out)
in the main page view, a nonce is created and stored in the database
The page is then served
in the served page, there is now javascript (from static/js/helper.js) which makes an async request
at a new "/nonce/" reout
If there is a nonce with value <nonce_value> in the database AND it's less than 60s old, then the stripe public key is served and subsequenctly set by a call back.
So the key is only available in a 60s window from request initiation to the client.

I suspect this will form only one part of a larger solution, but it is one part, and it is working.

further efforts to obfuscate the key will occur after implementing this, then rolling the key.

This PR replaces #34