Refactor authentication factors to factors.py.
Make OATH add credential key_handle a list of allowed key_handles.

For operational reasons, backends will likely have to allow adding
OATH credentials using more than one key handle during key rolling.