So the flow for accessing GitHub's API with 2FA enabled is this:

- You request a protected resource via Basic Authentication.
- The API responds with a 401 and includes an `X-GitHub-OTP` header.
- The client must then respond with the 2FA code in a header and the credentials again.

The simplest way for `github3.py` to expose this without allowing users to set arbitrary headers, was with a callback. `github3.py` will not provide a default callback so you have to register your own, see [L195](https://github.com/seveas/git-hub/pull/27/files#diff-88fb15e32f4101f90004ef18b66b704bR195). This provides a `GitHub` object with a registered callback. Since the `authorize` call can require the user to pass `2FA` they then need to be prompted for it. 

A future API improvement (to `github3.py`) may be to allow you to pass the callback in the generic `authorize` call, but for now this is how you have to create tokens for `git-hub`.

The next change, then simply reuses the GitHub object to login with the token and username. Since you're using a token you shouldn't see the callback being used. Tokens bypass the use of 2FA entirely. I can revert the next change, but this one is entirely necessary.