Journalist login

Implements two-factor authentication on the document interface.

Users can be admins, in which case they can access a CRUD interface for adding, editing and deleting other users. The initial admin user can be created with `./manage.py add_admin`, just follow the prompts.

This PR provides support for Google Authenticator - you will need the Google Authenticator app on your phone to set up a user account. Support for other authentication methods should come in follow-up PR's.

This PR adds two dependencies, one for computing OTP's (HOTP and TOTP supported) and one for generating QR code's. Care has to been to taken to minimize the number of unneeded dependencies, see comments for details.

Still needed (coming soon):

1. fix tests that were broken by these changes (you need to log in now)
2. add new tests to test the login flow and admin interface
3. naming consolidation (currently the document interface users are called Journalists, but I think I might prefer Users)