redesign & rewrite user_list.php

- removed token seed as it is a security risk because users with access to it may steal the token thus circumvent OTP without anyone noticing
- replaced user pin with a set of string for same reason as token seed, string are
  'default' -> the user has not set her/his own pin thus the pin set by admin will be used
  'self defined' -> the user has set her/his own pin which will be used
  '' -> no pin is required as none are set
- added TODO file
- moved styles of user_list table to styles.css

Signed-off-by: Andrwe Lord Weber <lord-weber-andrwe@andrwe.org>