Proper Authentication for Users

[jlbooker]

Provide a re-thought-out authentication system for the Users module. The planned API should be pluggable and allow for multiple types of authentication to be used on one site at the same time. For details, see Jeff's wiki page: https://github.com/AppStateESS/phpwebsite/wiki/Auth

┆Issue is synchronized with this Asana task

[jtickle]

Look into RFC 6238 - Time-based One Time Password Algorithm. There appear to be a number of PHP libraries for this. You generate a QR code for your user, they load it into whichever TOTP app they want (Google Authenticator is one, Duo Mobile is for people afraid of Google), and wham bam thank you m'am, phpWebSite has two-factor authentication. You could conceivably require Shibboleth first, and then once they're back at the site, send them to the second factor.