add 2-factor device stuff that will be shared between cloudos and cloudstead