Verify tfa before setup new one

- Refactor about Token::ResetPassword and Token::Activation
- Replace Token::SmsToken with TwoFactor::Sms
- Unify behaviors of setup sms/app two factor authenticator
- Add some key feature tests for both tokens and two_factors
- More i18n translation fixed
- Must pass through previous TFA before setup the second TFA
- TFA verification before visit the admin panel
- A lots of bugfixs and code quality improvements