Verify 2fa code before activation

[raffis]

Describe the bug

Currently 2fs gets enabled without verifying the code.
This might lead to account lockouts if the code can not be scanned for whatever reason.

To Reproduce

1. Enable 2fa
2. Don't scan code
3. Restart browser
4. Lockout

Expected behavior

Prompt for the code to verify 2fa.

Environment

• web-client version: v3.2.17
• balloon server version: v2.7.2