use 2fa directly instead of auto-preauth strategy
Merge pull request #1323 from heroku/no-more-preauth

use 2fa directly instead of auto-preauth strategy