Implement two factor authentication

If enabled, require a second factor to acquire a session cookie and
reject basic authentication attempts (as second factor cannot be
presented). Allow previous and next token for clock skew.

To enable this, you add a "2f" object to your user doc with a secret
"key" value.

This work is currently missing tests and documentation, and we'll
also want a UI (to render a QR code with an otpauth url for easy
setup).
Can we call it "otp" or "totp" instead of "2f"? "2f" may be shortcut, but I found my self again confused by auto converting it into 47 number. With explicit "totp" abbreviation we also gives an implicit reference onto implementation since two factor auth may be very different.