Banish the concept of "api_token" from Config

It doesn't seem it was ever used. I probably kept it by mistake after
transitioning to OAuth.
Rewrite API auth to allow Enterprise email login

API authentication and persisting of credentials in Config was
convoluted and inflexible, and it wasn't possible to log in with
different credentials than your GitHub screen name. Since Enterprise
supports different authentication schemes, it's important to allow
emails for login as well (or any string for that matter) and retrieve
the user's screen name after successful authentication.

This also improves handling special characters in Basic Auth usernames
and passwords.

Fixes #407
Fix 2FA for users that receive code via SMS

hub initially tries to fetch user's existing OAuth token for hub if it
exists, and will prompt the user for a 2FA code. However those who
receive it via SMS would never get the code since a GET to GitHub's
Authorizations API purposely doesn't trigger an SMS. There's some
discussion as to whether this is an API bug for not, but in the
meantime, make a dummy POST request for the sole reason of triggering
the SMS.

Fixes #412, closes #435, closes #445
Merge branch 'auth-fix' into 1.10