This includes complying with standards that allow mobile browsers to
create a pseudo-app out of the site, complete with homescreen icon,
splash-screen, and a minimal browser-less UI

Also file permission cleanup

2FA class stolen from RobThree and stripped down.
Works best with qrencode utility installed, but will fall back to using
google charts if qrencode is missing.