Feature/2fa

Implement 2FA with SMS. 

2FA is currently required for Admin access, however, the only admin-only pages are client applications owned by somebody else.

TODO (in another PR): 
- build admin page
- allow users to require 2FA
What was the `except: [:resend_token]` about?