make the temp wto factor auth cookie a short lifetime
add UI to remove mobile phone
when removing mobile, disable 2fa and clear the mobile auth code