Don't leak the token keys through GET requests

Most webservers log GET requests and their data to the disk in plaintext. Obviously this is not acceptable for the secrets to our OTP tokens. Instead we transfer the data through django sessions as a backchannel.

Additionally edited the QR view to allow users to override it and provide a different image factory. For example if they have PIL/Pillow installed they may wish to build PNG images instead.