Prevent brute forcing 2FA codes

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Reduce TOTP refresh window

Prevent giving a large window for the validity of single OTP codes

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Prevent 2FA replay attacks

Do this by waiting for two minutes after last successful login, forces code to be regenerated.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Merge pull request #2571 from Dragooon/release-2.1

2FA security improvements