Implement time-based token for user login as described in RFC 6238.
New column in account table is a base32 of token key bytes,
coincidentally it is the same format Google's Authenticator Android app uses.
If you want that to work, set system time on server correctly. Maybe use ntpd.
There may be bugs.