Added "Very Secure" ACL rule indicating OTP requirement.

Untested, but the general idea is there.  Also a note about how "human_readable_repr" is doing it wrong.  Might submit a swap-out of that for the standard mechanism in a different merge request.
A similar expression is used elsewhere, I'll combine those into a method on the user model