Start for TOTP auth. Still need client-side logic and setting cookie.
TOTP security enabled and functioning.