optionally enable duosecurity for multi-factor auth

* systemd now uses global.conf to affect container startup
* admin scripts are now informative
* add admin script to destroy a running app+data container pair
* be less verbose during build to avoid truncating wercker log
* add table of contents to readme
* update systemd service unit on upgrade
* add stock password-auth pam config
* optionally enable duosecurity for multi-factor auth