Also create seperate account security options page

This commit requires a new database table

These features only have any value if users actually use them, and
experience has shown that nowhere near enough users use them to make
them worthwhile.

ISPs can't see filenames through TLS. This option is useless in a
codebase that forces HTTPS, and only confuses users.

Fixes #27

Note that this requires a minor database migration of SiteOptions in
users_info and Paranoia in users_main

2FA class stolen from RobThree and stripped down.
Works best with qrencode utility installed, but will fall back to using
google charts if qrencode is missing.