this feature is not security related perse, it's just a way to block
bots and web crawlers. The challenge is occurring only on public pages.

This includes complying with standards that allow mobile browsers to
create a pseudo-app out of the site, complete with homescreen icon,
splash-screen, and a minimal browser-less UI

Also file permission cleanup

2FA class stolen from RobThree and stripped down.
Works best with qrencode utility installed, but will fall back to using
google charts if qrencode is missing.