Improved TOTp handling in login.

Cleaned up the code a bit, also checks TOTP before attemping to verify
user.

This addresses the potential for an attacker to try at a password
and/or confirm that the password is correct unless they have a valid
TOTP code for the request. A failed TOTP response will trigger a
throttle count on the login as well.

resources/lang/en/strings.php

@@ -12,7 +12,6 @@ return [
     'password' => 'Password',
     'email' => 'Email',
     'whoops' => 'Whoops',
-    'failed' => 'Your request could not be processed. Please try again later.',
     'success' => 'Success',
     'location' => 'Location',
     'node' => 'Node',