remove twofactor:enable and disable

it was a fun novelty but in practice we want to avoid rendering
the secret in a qrcode since it might be saved with the terminal
history.

plus the web flow makes a lot more sense
revert 2fa changes in Auth, no need to keep the session password
Merge pull request #1105 from heroku/pedro-remove-2fa-enable-and-disable

Remove 2fa:enable and disable