Added TwoFactor Authentication (RFC4226)

Tested against Google-Authenticator app on Android 4.4.4

Made `verify_hotp` more efficient.

Added autofocus on twofactor input

Added GUI Unlock and Remove for TwoFactor credentials in /edituser/

Allow additional tries after elapsed time from last try exceeds configured parameter `$config['twofactor_lock']`.
If `$config['twofactor_lock']` is not defined or is set to `0`, administrators have to unlock accounts that exceed 3 failures via GUI.

Added Documentation

Moved TwoFactor form to logon.inc.php
Disabled autocomplete on twofactor input field
Updated Docs to include link to Google-Authenticator's install-guides

Moved authentication logic from authenticate.inc.php to twofactor.lib.php

typo in docblock for `twofactor_auth()`

Fixed scrutinizer bugs

To please scrutinizer

html/pages/logon.inc.php

@@ -1,3 +1,7 @@
+<?php
+if( $config['twofactor'] && isset($twofactorform) ) {
+  echo twofactor_form();
+} else { ?>
       <form class="form-horizontal" role="form" action="" method="post" name="logonform">
         <div class="form-group">
           <div class="col-sm-offset-2 col-sm-10">
@@ -56,6 +60,8 @@ if (isset($config['login_message']))
 document.logonform.username.focus();
 // -->
 </script>
-
+<?php
+}
+?>
     </div>
 </div>