Keep user logged out until they submit valid 2FA token. props cathyjf

Previously the user was logged in after entering a valid username/password, then logged out and prompted for their 2FA token. They were sent auth cookies when they were logged in, and even though those cookies were expired during the logout process, an attacker could pull the original cookies out of the HTTP headers and manually create them in their browser, which would allow them to login. In this scenaior they never had to enter a valid 2FA code.

See http://iandunn.name/security-reward-for-new-google-authenticator-plugin/ for details.


git-svn-id: https://plugins.svn.wordpress.org/google-authenticator-per-user-prompt/trunk@819086 b8457f37-d9ea-0310-8a92-e5e31aec5664