Implement admin-configurable secret key length

The RFC standard calls for at least 128 bits, with 160 bits recommended,
however since our goal is being compatible with google authenticator pam
module and its satellite utils, we default to 80 bits. Due to the nature
of TOTP, there is very little gain in going with more bits than 80,
while it makes generated keys a lot longer and more tedious to manually
input into phone apps.

This commit also reimplements the way we generate secret key. I
reimplemented the solution I found in pyotp, but it wastes a lot of good
randomness for no reason.