break out the config protection box into it's own widget
refactor to use the broken-out config protection box
refactor the oath page to use new access code box
refactor staticpage to use new access box
refactor chalresppage to use new access code box
refactor settingpage usage of access code to use new box