Implement two factor authentication

If enabled, require a second factor to acquire a session cookie and
reject basic authentication attempts (as second factor cannot be
presented). Allow previous and next token for clock skew.

To enable this, you add a "2f" object to your user doc with a secret
"key" value.

This work is currently missing tests and documentation, and we'll
also want a UI (to render a QR code with an otpauth url for easy
setup).
yeah, I wasn't sure on the name so I just put something short. I was thinking of a "2f": {"type":"totp","key":"hello"} thing so we're not tied to totp algorithm.