add menu link
delete sms_token in session after trying 2 factor auth

If failed 2 facotr auth, delete request data(POST data)