Handle 2fa tokens

This was a problem with `hub` for a bit too: `octonaut` doesn't happily support the 2FA flow which is :crying_cat_face:.

I've added a retry loop which accepts the 2FA token correctly. (This PR also includes the note fix from https://github.com/pengwynn/octonaut/pull/21 which is slightly poor form. Since the `create_authorization` didn't work correctly, I wanted that fix included here.)