Mess with training modes

[krizhanovsky]

See 4d690f4 :

basically the current TRAINING_MODE="off" is more or less the same as "real" with only exception that we adjust parameters on live sliding window instead of single historical observation. I'd expect from this mode to rely on explicitly defined thresholds.

Probably we can leave this mode, but it should not be treated as no training. This mode is also have huge false positives, react on normal traffic spikes, and negatives, not to react on slowly increasing malicious load.