Add support for time based OTPs for two factor authentication.

Hopefully Google won't disable QR Code support in their Charts API any time soon...
include the user in the query here, rather checking on the next line, in case both this user and another user happen to have had the same OTP code