sharedKey TOTP scheme, Add Content-Security-Policy + X-Frame-Options, fix /blocks, add filesaver.js