Add framework for RFC-6238: Time-Based One Time Password Algorithm.

This provides a system for two-factor authentication, using a compliant
OTP-generator such as Google Authenticator. The framework includes a
validator for use on API calls needing authentication as well as a UI
for provisioning/resetting your secret key. A secure cookie may be
generated to effectively turn the user's browser into a temporary
authentication factor.

This feature is currently limited to admins only until full-site SSL is
available.

r2/example.ini

@@ -110,6 +110,8 @@ https_endpoint =
 login_cookie = reddit_session
 # name of the admin cookie
 admin_cookie = reddit_admin
+# name of the otp cookie
+otp_cookie = reddit_otp
 # the work factor for bcrypt, increment this every time computers double in
 # speed. don't worry, changing this won't break old passwords
 bcrypt_work_factor = 12
@@ -409,6 +411,8 @@ min_membership_create_community = 30
 ADMIN_COOKIE_TTL = 32400
 # the maximum amount of idle time for an admin cookie (seconds)
 ADMIN_COOKIE_MAX_IDLE = 900
+# the maximum life of an otp cookie
+OTP_COOKIE_TTL = 604800
 
 # min amount of karma to edit 
 WIKI_KARMA = 100