Workaround for PEP8 validation of E123
Fixed #30 -- Don't transmit token seed through GET parameters

* Allows overriding the QR Image factory.
  This way if PIL/pillow is available PNG images can be used, etc.
* Make the QRCode Factory configurable with TWO_FACTOR_QR_FACTORY.
  This allows users with PIL/Pillow or pyimaging installed to generate PNG
  images instead.
* Don't send the secret key via GET so it doesn't show in the access logs.