Use redis for "used OTPs" storage.

Keys expire automatically, so there's no problem after a continuous
usage. With database, after a few hundred logins, probability for
false positive is already quite high.
Show login timout for emulate_legacy users.
Show warning when SMS code expired.

Fixed #70
Merge branch 'master' of github.com:ojarva/sso-frontend
Small fixes:

- Requirements updates
- Smoke testing setting and stubs
- IDs and class attributes for automated testing
- Small bugfix: standard says cookie maxage must be integer, but was
  float.
- Removed debug console.log messages from onlybefore/onlyafter handlers.
- moment.js improvements: a few seconds -> half minute -> minute