use existing helpers to encode json

fix #974
v3.7.4
bring json require back
v3.7.5
remove twofactor:enable and disable

it was a fun novelty but in practice we want to avoid rendering
the secret in a qrcode since it might be saved with the terminal
history.

plus the web flow makes a lot more sense
revert 2fa changes in Auth, no need to keep the session password