Let the user pick 2FA method

See merge request !2

Add links 'use a numeric / hardware token instead' to the 2FA login
pages, using the list of available 2FA mechanisms found in the
auth Response.

First step towards letting users pick the method they prefer.

This caused the SSO server to generate bad form links, which caused a
302, preventing POST requests to succeed.

Add some template customization options in the config

See merge request !1

Support serving site-specific logo, favicon, and setting a site title.

Upgrade it to 4.1.3, including dependencies.

Just serve an error on the logout page if there is no valid session,
instead of redirecting to the login workflow.

Fixes issue #8.

Fixes issue #6.

And standardize on a single structure for the gorilla session
map, using the 'data' key for our gob-encoded objects.

Using the new configuration variable 'keystore_enable_groups'.

Likely fixes issue #7 (untested).

Without this field, U2F just isn't working and the accounts with U2F
set up are shown an OTP prompt.