Removed duplicate num_session queries.

Context processor is automatically adding number of open sessions
already. Additionally, value set by context processor is cached to
redis.
Formatting and wording improvements

- Formatted settings page with panels
- Better info on settings page: Authenticator is always recommended,
  even when using only SMS. Show big warning when it's not configured.
- CSP reporting: clarify that reports are not problems, and probably
  there's no need to fix those.
Catch exceptions from socket.io