UserSessionController::validate_code does not correctly handle validation codes with leading zeros

Consider the user enters the validation code "012345".  The list of `valid_codes` in `UserSessionController::validate_code` will contain `ROTP::TOTP.new(two_factor_secret).now`, which is the integer `12345`.  When you call `.to_s` on that integer, you'll get "12345". `"012345" != "12345"`, so even though the code was correct, validation fails.  The solution outlined in my pull request calls `.to_i` on the validation_code that the user passes in and no longer calls `.to_s` on the validation codes computed by ROTP.