Sign in: stronger rate-limiting to prevent sending too many emails

[mesosoi]

The 2FA code should not be generated again if it was recently created and sent in the same session.