DisableView doesn't require request user to be verified
`DisableView` only checks that the request user *has* a valid, not that the user is verified.

It is possible that if a site has been misconfigured and allows users to bypass django-two-factor-auth's login view (e.g. the admin site hasn't been configured correctly and admins can login without 2fa) and then disable that user's two-factor device(s). At this point an attacker could go set up a new two-factor and gain access to views protected by `otp_required`.

This bug could also be exploited if the user has multiple sessions open before enabling two-factor auth. Any other session could then disable two-factor auth without having access to the device.

## Expected Behavior

`DisableView` should check if the current user has two factor auth enabled on their account *and* has used it to log in on this session.

## Current Behavior

`DisableView` only checks that the user has two factor auth enabled on their account.

## Possible Solution

Swap `login_required` for `otp_required`. Write some tests too.

## Steps to Reproduce (for bugs)

```
>>> from two_factor.views.profile import DisableView                                                                                                                                                   
>>> from django.contrib.auth import get_user_model
>>> from django.http import HttpRequest
>>> user = get_user_model().objects.first()
>>> user.staticdevice_set.get_or_create(name='backup')
>>> print(getattr(user, "is_verified", "user has no is_verified method"))
user has no is_verified method
>>> request = HttpRequest()
>>> request.user = user
>>> request.method = "GET"
>>> DisableView.as_view()(request)
<TemplateResponse status_code=200, "text/html; charset=utf-8">
>>> request.method = "POST"
>>> request.POST = {"understand": "on"}
>>> DisableView.as_view()(request)
<HttpResponseRedirect status_code=302, "text/html; charset=utf-8", url="/user/home/">
>>> print(user.staticdevice_set.count())
0
```

It should also be possible to reproduce this bug by logging in from two different browsers, enabling two factor auth on one session and then disabling it from the other (I've not tried it due to time constraints) 

## Context

<https://github.com/Bouke/django-two-factor-auth/issues/253#issuecomment-701881736> prompted me to look at the source code.


## Your Environment
<!--- Include as many relevant details about the environment you experienced the bug in -->
* Browser and version: n/a, this was done via the shell
* Python version: 3.6.12
* Django version: 2.2.15
* django-otp version: 0.9.4
* django-two-factor-auth version: 1.12.1
* Link to your project: https://github.com/Bouke/django-two-factor-auth

DisableView doesn't require request user to be verified
`DisableView` only checks that the request user *has* a valid, not that the user is verified.

It is possible that if a site has been misconfigured and allows users to bypass django-two-factor-auth's login view (e.g. the admin site hasn't been configured correctly and admins can login without 2fa) and then disable that user's two-factor device(s). At this point an attacker could go set up a new two-factor and gain access to views protected by `otp_required`.

This bug could also be exploited if the user has multiple sessions open before enabling two-factor auth. Any other session could then disable two-factor auth without having access to the device.

## Expected Behavior

`DisableView` should check if the current user has two factor auth enabled on their account *and* has used it to log in on this session.

## Current Behavior

`DisableView` only checks that the user has two factor auth enabled on their account.

## Possible Solution

Swap `login_required` for `otp_required`. Write some tests too.

## Steps to Reproduce (for bugs)

```
>>> from two_factor.views.profile import DisableView                                                                                                                                                   
>>> from django.contrib.auth import get_user_model
>>> from django.http import HttpRequest
>>> user = get_user_model().objects.first()
>>> user.staticdevice_set.get_or_create(name='backup')
>>> print(getattr(user, "is_verified", "user has no is_verified method"))
user has no is_verified method
>>> request = HttpRequest()
>>> request.user = user
>>> request.method = "GET"
>>> DisableView.as_view()(request)
<TemplateResponse status_code=200, "text/html; charset=utf-8">
>>> request.method = "POST"
>>> request.POST = {"understand": "on"}
>>> DisableView.as_view()(request)
<HttpResponseRedirect status_code=302, "text/html; charset=utf-8", url="/user/home/">
>>> print(user.staticdevice_set.count())
0
```

It should also be possible to reproduce this bug by logging in from two different browsers, enabling two factor auth on one session and then disabling it from the other (I've not tried it due to time constraints) 

## Context

<https://github.com/Bouke/django-two-factor-auth/issues/253#issuecomment-701881736> prompted me to look at the source code.


## Your Environment
<!--- Include as many relevant details about the environment you experienced the bug in -->
* Browser and version: n/a, this was done via the shell
* Python version: 3.6.12
* Django version: 2.2.15
* django-otp version: 0.9.4
* django-two-factor-auth version: 1.12.1
* Link to your project: https://github.com/Bouke/django-two-factor-auth