various two factor auth improvements

* [x] implement TOTP checking in postgres
* [x] move two factor auth verification to postgres
* [x] remove the frontend's direct access to read TOTP secrets, but still let it set them
* [x] require 2fa at the database level for protected actions like login, withdrawal and turning off 2fa
* [x] create the tables for two factor auth recovery tokens
* [x] create the functions for two factor auth recovery tokens
* [x] create the frontend for two factor auth recovery tokens
* [x] make the tests pass
It seems like both are the same in this context but you must use `:=` if you are doing a function call with named parameters. i.e. for a `function foo(x integer)`, `foo(x := 1)` and `foo(1)` are the same, `foo(x = 1)` is not.
Source: http://stackoverflow.com/questions/7462322/the-forgotten-assignment-operator-and-the-commonplace