change how "has OTP-authenticated" is stored

1. store data in $_SESSION rather than preferences
2. store the time of last OTP auth, rather than a temporary flag

This goes to our discussion on #3.

It is key that we not only put things in the session, but also switch to a model where the key must always be present for login.  We store the time of last login immediately on login to deal with the possibility that the 2FA_login entry in the session may still be present by some fluke.  (I would have used a unique pre-existing per-login id, but I'm not aware of one.)