Add support for 2FA in applications without state

[johanib]

Currently, it is not possible to use stateless 2fa methods, like TOTP or Google Authenticatior without a session.
In the linked issue / PR, this was implemented and merged into 8.x.
However, these changes did not make it into the final release.

Prior discussion:
#273
#265

Can we re-introduce these changes, so we can use 2fa in a stateless app?

PR: #307
PR: #308