Use time-based authentication codes

This changeset reworks the manner in which secondary authentication codes are generated and verified.  Much of the work is based off of [this article](https://coderwall.com/p/qw7hwq).

This has the following benefits:

 * Gem is now much closer to compliance with [RFC 6238](http://tools.ietf.org/html/rfc6238) with the ability to be fully compliant based on how it is implemented.
 * [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en) is now supported as a mechanism by which one-time codes can be retrieved.
 * Some level of testing is introduced.

This is definitely a breaking change so would require a major version bump - would love to hear any thoughts and welcome any additional changes to this PR.