optionally enable duosecurity for multi-factor auth

The default is to **not use** duo.
You must edit your local configuration in order to enable duo.
See the readme, global.conf, and login_duo.conf for details.
update systemd service unit on upgrade

045122c2 updates the unit file on build;
we should also update the file on upgrade.
the test for BZ1099206 uses a login shell for reliability