changed two-factor system to HTTP_USER_AGENT

REMOTE_ADDR is not reliable, because IP addresses can change over time.
However, if the client is using, let’s say a couple of machines with
the same browser all the time, it is less likely that the warning will
appear. Obviously this system will also cause trouble for faking user
agent, so if the hacker knows the full user agent string of another
person, they are able to pass this system easily, but as I do not have
a location system I am not able to check for far away distance logins
and compare them with previous locations. This is good enough, I think
this works just fine and if you think there is a more precise way to do
this thing, feel free to let me know by making an issue (and a pull
request, if you have any code to share).