don't guard mobile auth page

Summary:
Don't protect the mobile auth page, since that gets POSTed to while we have a user but haven't been redirected to a protected destination yet

Fixes T3051

Test Plan: manual with user agent spoofing

Reviewers: chester, ben, peter, kevin, omar

Maniphest Tasks: T3051

Differential Revision: http://phab.duo/D1408
update duo-filter revision