Minor tweaks

Fix usage of XHTML instead of HTML5 in the login_tfa template
Fix parse error in upgrade (fixes #2574)