Better Protect Secret Key

[julien731]

The secret key should not be displayed in clear text (security reasons). Instead, it should be retrieved by either:

• Asking the user to re-enter his password and ask for confirmation that the current network is safe
• Sending an e-mail to the user

[christophwolff]

+1

[julien731]

After thinking about this issue, I don't see a case where a non advanced user would need his secret key. Any advanced user would be able to retrieve it from the database. Consequently, the secret key should be removed from the user edit screen.

However, this means other changes have to be made in the overall activation process. Ad of now, a user can click "Generate Secret", which makes sense as the user then sees the secret key. If no key is displayed, though, this make a lot less sense.

From the user perspective, 2FA activation and secret key generation should be one and only one thing. See #28 for more details.

[julien731]

With #31 the secret key will now be removed from the dashboard.