Re-imported from Sai's repo.
Changed since Sai's last commit:

Login no longer redirects to user/pass page if 2fa code fails to validate, bounces to 2fa page again
You can no longer lock yourself out by enabling 2fa and not saving the code, it will not be activated unless you input the 2FA codes
After enrolling or unenrolling in 2FA, you are redirected to the user CP which shows a message about it

Various functional/security fixes in Auth.java
Merge branch 'master' of https://github.com/TheWug/phoenix