change AUTH_DISABLE_OTP to a config
swap out _ENABLE_PDO for config
flip VERBOSITY usage in _debug
move more things out of include/functions.php