Add two-factor authentication support

Fixes #4.

This was a bit more work than I expected! :laughing: To support 2FA without having to enter the 2FA auth code every time, I had to refactor the login from using Basic auth to token-based auth (also needed for the stream view... more on that in a sec). Overall, I think this is better though, since storing someone's password in plaintext isn't too safe.

I had to refactor the stream view to use an API route, since the Atom feeds only support Basic auth, which doesn't work with 2FA nicely. The API route (`/users/:user/received_events`) doesn't include the user-friendly text description, so I had to manually construct it. This does remove one dependency on `xml2js` though!

I did my best to follow your code style. Let me know what you think!