Fix known 2fa issues

[comendantmc]

This PR addresses some of the 2fa issues I encountered, some of which are mentioned in #139.

List of changes:

• Kick player after each incorrect 2fa code
• Add additional brute-force check for 2fa
• Don't assign 2fa unless the user types /2fa verify <code>