Fix security bug regarding long lived threads

[redshiftzero]

Fixes #178

[redshiftzero]

So the way to test this is to follow the steps in #178 (adding a log line prior to the time.sleep in each thread). Then when you log out you should see:

2018-11-15 13:59:17,166 - root:146(run) INFO: still here with self.api: <sdclientapi.API object at 0x11136b390>
2018-11-15 13:59:17,238 - root:100(run) INFO: still here with self.api: <sdclientapi.API object at 0x11136b390>
[ --- user clicks log out here --- ]
2018-11-15 13:59:22,171 - root:146(run) INFO: still here with self.api: None
2018-11-15 13:59:22,239 - root:100(run) INFO: still here with self.api: None
2018-11-15 13:59:27,175 - root:146(run) INFO: still here with self.api: None

[emkll]

Went though the test plan in qubes and works as expected, thanks @redshiftzero . Invalidating tokens server-side is tracked as part of freedomofpress/securedrop#3933