decouple authentication logic from cookie code
move RevokeToken impl into derived class
update nugets
API cleanup
only put account into 2fa mode if authentication is being done for signin purposes (rather than change email/password purpose)