ISPs can't see filenames through TLS. This option is useless in a
codebase that forces HTTPS, and only confuses users.

This allows for some browsers like chrome mobile to change the color of
the address bar to smoothly match the theme of the page

Also file permission cleanup

2FA class stolen from RobThree and stripped down.
Works best with qrencode utility installed, but will fall back to using
google charts if qrencode is missing.

Should have been part of commit b1b1c6a68d

Default as of 5.7. Now enforces that NOT NULL fields are nott attempted
to be set to NULL (like whenever we do an insert without specifying a
text/blob field value (which can't have defaults))

This actually matters now that we have namespaces, and there's no reason
not to bring it up to 255 characters. mysql is going to use 1 size byte
as long as we're below a maximum of 256 characters

It's what we were using it for anyway

This keeps it inline with what.cd's naming convention