Remove yubikey single-factor authentication.
Re-level password validation with otp check.
Add more info about otp as extras request params.