toto auth tokens can only be used once. adds login form to the /totp page so I can send a link directly to people