Introduce initial code for two-phase auth support.

This commit adds a simple NoOTPDevice model that currently serves
the purpose of responding successfully to any request. The login view
has been extended with proper OTP device setup and initial verification
support.
Introduce a dummy token input.
Support TOTP with database storage (temporarily).

A dedicated database model is used to store the secrets. If user does
not have a secret, it is assumed that he disabled OTP.
Introduce 'otp-setup', to set TOTP up.
Support displaying QRCode for TOTP URI.
Support SOTP recovery keys.
Revoke used tokens atomically.

This should prevent replay attacks on TOTP and SOTP.
Re-use TOTPDevice for handling 'OTP disabled'.

There's no point in having a special device that checks if TOTP secret
is set. Let's just do that in TOTPDevice.