Prompt for 2fa on stderr instead of stdout

This means that a 2fa prompt is still visible if, e.g., one is
piping the result of a heroku command which requires 2fa into
another command.
Merge pull request #1234 from deafbybeheading/prompt-for-2fa-on-stderr

Prompt for 2fa on stderr instead of stdout
block all commands while updating