protect password reset with 2fa

This needed some internal changes, because now 2fa data needs to be
checked for a user that is not logged in. Providers may need adjustments
if they access user data.

protect password reset with 2fa

This needed some internal changes, because now 2fa data needs to be
checked for a user that is not logged in. Providers may need adjustments
if they access user data. They should use the getUserData() method of
the abstract Provider class to do so.

show more ...

some cleanup and streamlining for providers

make tolerance easier to override in config

use action to register providers

fix cookie security

The cookie is now tied to the provider and cookie secret. This way it
can not be constructed without inside knowledge.

Removed old code

The basic mechanisms have been reimplemented, so the old code has been
removed.

remember 2fa authentications

initial login handling

use Manager singleton to check and load providers

basic profile managment refactoring

We now use standard OTP passwords for all providers by default.

first go a profile refactoring