Merge pull request #49 from mgorny/merged-settings

Move middleware & installed app settings to common.
Introduce initial code for two-phase auth support.

This commit adds a simple NoOTPDevice model that currently serves
the purpose of responding successfully to any request. The login view
has been extended with proper OTP device setup and initial verification
support.
Introduce a dummy token input.
Support TOTP with database storage (temporarily).

A dedicated database model is used to store the secrets. If user does
not have a secret, it is assumed that he disabled OTP.
Introduce 'otp-setup', to set TOTP up.
Support displaying QRCode for TOTP URI.
Support SOTP recovery keys.
Revoke used tokens atomically.

This should prevent replay attacks on TOTP and SOTP.