Consider more login failure modes, consider email

[bickelj]

Users may not know/want TOTP, Twilio may go down again. We need a strategy that allows Twilio to go down and users to self-serve. Perhaps this is already covered by other issues, but perhaps not. One more suggestion is to allow email as a second factor for authentication.

It also appears we do not have a "forgot passphrase" link for passphrase reset.