Ref T4398. This prompts users for multi-factor auth on login.

Roughly, this introduces the idea of "partial" sessions, which we haven't finished constructing yet. In practice, this means the session has made it through primary auth but not through multi-factor auth. Add a workflow for bringing a partial session up to a full one.

• Used Conduit.
• Logged in as multi-factor user.
• Logged in as no-factor user.
• Tried to do non-login-things with a partial session.
• Reviewed account activity logs.