Enabling 2FA should require TOTP

[kelunik]

Setting up 2FA shouldn't be done with a checkbox while the QR code is always shown. It should show the QR code only after a click on a setup button and require a first valid code to be entered then to ensure the user has set it up properly. Only after that, 2FA should be in an enabled state.

[paragonie-scott]

Okay, I'll rebuild that feature in version 2. :)