this makes sure we don't use an old otp_user_id from an old session

closes #8031

This:
* makes sure that after_database_authentication is called for users with
enabled 2fa.
* handles paranoid mode correctly

Actually it redirects to stream page and says that user is already logged in.

Fix https://github.com/diaspora/diaspora/issues/6326

* create a new token on a new session
* delete the current token on session exit

kill services users with fire. we need this feature, but we need to just start from scratch because this is redonkalonk

was failing in development

Something in devise broke for the :mobile format. More investigation needed; we're having this same issue on log out and incorrect password on mobile (though those pages are at least still usable).