Verify tfa before setup new one

- Refactor about Token::ResetPassword and Token::Activation
- Replace Token::SmsToken with TwoFactor::Sms
- unify behaviors of setup sms/app two factor authenticator
- Add some key feature tests for both tokens and two_factors
- More i18n translation fixs
- Using previous TFA to verify before setup second kind of TFA
- TFA verification for visit admin panel
- some bugfixs and code quality improvements