Allow overriding the QR Image factory.

This way if PIL/pillow is available PNG images can be used, etc.
Don't send the secret key via GET so it doesn't show in the access logs.