support two factor auth in ghsetup, closes #23