Add password hashing, user settings with 2FA, and project image lightbox.

Hardens auth with PBKDF2, lockouts, local QR setup, and safer embeds while moving account security under the username menu.

Web.config

@@ -13,20 +13,18 @@
 
 	<system.web>
 		<httpRuntime maxRequestLength="25600" executionTimeout="600" />
-		<!--
-			Generate your own machineKey (do not reuse the sample below) and paste it here.
-			You can generate one at https://www.mvcbuddy.net/tool/machine-key-generator/ or with
-			any offline "IIS machineKey generator" utility. This keeps auth cookies /
-			ViewState secure and consistent across app restarts.
-
-			<machineKey validationKey="..." decryptionKey="..." validation="HMACSHA256" decryption="AES" />
-		-->
-		<customErrors mode="Off" />
+		<!-- Generate your own keys for production. Never commit real keys to a public repo. -->
+		<machineKey validationKey="REPLACE_WITH_YOUR_VALIDATION_KEY"
+					decryptionKey="REPLACE_WITH_YOUR_DECRYPTION_KEY"
+					validation="HMACSHA256"
+					decryption="AES" />
+		<customErrors mode="RemoteOnly" />
 		<compilation targetFramework="4.7.2" debug="true" />
 
 		<authentication mode="Forms">
-			<forms loginUrl="/login/index" />
+			<forms loginUrl="/login/index" requireSSL="true" cookieless="UseCookies" timeout="60" slidingExpiration="true" />
 		</authentication>
+		<httpCookies httpOnlyCookies="true" requireSSL="true" />
 	</system.web>
 
 	<runtime>
@@ -88,8 +86,7 @@
 	</entityFramework>
 
 	<connectionStrings>
-		<!-- Point this at your own SQL Server instance. See README.md for setup instructions. -->
-		<add name="Context" connectionString="Data Source=YOUR_SERVER\INSTANCE;Initial Catalog=atakanozbancomdb;Integrated Security=true;" providerName="System.Data.SqlClient" />
+		<add name="Context" connectionString="Data Source=.\SQLEXPRESS;Initial Catalog=atakanozbancomdb;Integrated Security=true;" providerName="System.Data.SqlClient"/>
 	</connectionStrings>
 
 	<!-- IIS 413.1 FIX -->