gh-96 Do not autofocus the OTP code validation field automatically
gh-96 Do not show the code verification (step 3) when two factor auth is already set up

Kudos to @brianteeman for the suggestion
gh-96 Allow the secret key to be a string, supporting one time emergency passwords
gh-96 Have the emergency one time password actually work and get deleted from the database