This includes complying with standards that allow mobile browsers to
create a pseudo-app out of the site, complete with homescreen icon,
splash-screen, and a minimal browser-less UI
2FA class stolen from RobThree and stripped down.
Works best with qrencode utility installed, but will fall back to using
google charts if qrencode is missing.