review

Password and authenticator code.
Both factors are checked together, so a failure never says which one was wrong. Attempts are rate-limited per address and each code can be spent only once.