The .google_authenticator file has to be generated by the user that is going to attempt to use it.  Also, -W doesn't seem to work (results an in INVALID_WINDOW error in /var/log/auth.log), so use -w 1 to allow for a single concurrent token
Merge branch 'jp-fix-google-auth-generation'