Also create seperate account security options page

This commit requires a new database table

These features only have any value if users actually use them, and
experience has shown that nowhere near enough users use them to make
them worthwhile.

This was an automatic mass-replace. Manual replacement of array(...)
will continue

ISPs can't see filenames through TLS. This option is useless in a
codebase that forces HTTPS, and only confuses users.

Fixes #27

- Default interval now 30 seconds (breaking!)
- Don't add default parameters to QR code (smaller)

Fixes #22

Note that this requires a minor database migration of SiteOptions in
users_info and Paranoia in users_main

2FA class stolen from RobThree and stripped down.
Works best with qrencode utility installed, but will fall back to using
google charts if qrencode is missing.