As a user, I would like to be able to use 2 factor authentication as specified by RFC6238 when logging in.

## Feature Request Form
### Problem you are trying to address with this feature

Considering the danger of password reuse and the general need for security in account management, I would like to request basic opt-in 2 factor authentication using RFC 6238 such that users must present a time-based challenge code when authenticating.

### Your solution

Add to the user table a key as per https://github.com/pyotp/pyotp,
create an 2FA management page to allow enrol->verify and disable,
and if a user has a not-null secret key, after authenticating with password, prompt them for their security token.

If users are authenticating via OAuth, we can presume their provider can support multi-factor authentication.

### Add tags - did you add labels?
I don't think I've got those permissions.

If this a customer requested feature, make sure to add that label.