add no arg constructor and get/set on attributes
fix userFromXml, perserve status
add secondFactor
allow getServerEnvironment to throw exception
initial cut at two-factor auth with authy