Implement time-based token for user login per RFC 6238.

This adds some more security for the tinfoil hat folk around us. 
To properly use, set token_key fields with secure key in base32 form, and make sure your server time is set properly - time() returns GMT/UTC time, and ntp is synchronising time on server. 
Install google authenticator on your phone, and input the base32 token_key. You should be ready to go.