Fix 2 index issues + broken config

This fixes 2 index issues for #614 and #615

1. add index on `:unlock_token` for `brute_force_protection`
2. add multi-column index on `[:provider, :uid]` for `external`

It also fixes the broken config where `remember_me_httponly =` should be moved out of the `user` block.

Lastly it fixes 1 small typo.