Implement two factor authentication

If enabled, require a second factor to acquire a session cookie and
reject basic authentication attempts (as second factor cannot be
presented). Allow previous and next token for clock skew.

To enable this, you add a "totp" object to your user doc with a secret
"key" value.
I left the skew unconfigurable for now. It seems this 90 second thing is quite standard.