last things and fixes for some of the iSec reported issues

Inlcudes some of the fixes for issues reproted by iSec and the fix for unattended-upgrades that I was working on when iSec started the sec audit. Closes #439, #437, #435, #441 

Also adds
- the facistfirewall setting to torrc file so that the ports could also be restricted in the iptables rules. 
- Example network firewall rules
- xSendFile so that large files can be downloaded
I'm confused. This adds "proper" 2-factor to the journalist interface, true, but it's still using `google-authenticator-apache-module`, which we need to get rid of, correct?