OneToOneField is slightly nicer (we can get the User object directly from the profile object

Also, I want to take advantage of DJango's build in user profile support - this is needed for that IMO
New model for Two Factor auth
onetimepass for two factor auth (TOTP)

I prefer this module over python-oath, it's a smaller code base and Py3K
support. python-oath also implements skew for TOTP, I don't think we want that