reject loading two-factor form if we haven't been through /login first

Right now, loading /login/two-factor without any email or password in
the cookies will display the second factor form.

We shouldn't be able to load this page without having entered an
email/password first.
Merge pull request #97 from dmathieu/no_two_factor_without_login

Reject loading two-factor form if we haven't been through /login first