Scratch code support for Two Factor Authentication

[quantum5]

Currently, we expect people who are locked out of 2FA to contact admins, which will then manually disable 2FA. This works when we actually know the people involved, as identity is an important part of authentication.

For a more general solution, we should implement scratch codes. These codes should be much longer and harder to guess than standard 2FA codes.

This is what we roughly expect from the system:

• code is shown once upon generation, and never shown again
• we offer 5 codes at a time
• using a code invalidates it
• regenerating codes invalidates all old codes
• regeneration button shown on edit profile, when 2FA is enabled
• codes are also generated and displayed after enabling 2FA
• easy code copy button, which adds surrounding text as well to describe what the codes do
• perhaps a print button to generate a PDF (security concerns? at least we can block on phantomjs now that we have gevent)