custom_header.custom_insert
* Use base32 for 2FA scratch token * rename Secure* to Crypto*, add comments