fixes #416
Fixup log message so it's properly generic
basic journalist login with username/password
Add "is admin" flag to Journalist
Add view decorator for admin-only pages

* clarify similar code in login decorator
* stash logged in user in `g`
basic admin interface with crud for Journalists
add users from admin interface
add timing metadata to journalist users for auditing
Use exceptions for login error handling
admin users automatically go to admin index
function to set password for Journalists
process edit user form submission
manage.py command to add new admin users
generate and show otp secret for new users
print qrcode and shared secret after manage.py add_admin
add deps for Google Authenticator

* pyotp for computing two factor values
* qrcode for generating easily scannable qr codes for shared secrets
check two factor code on login
better provisioning uri for Google Authenticator
merge login pages
HOTP login for admins