Separate second-factor verification and delivery from auth (#40)

backend/product/auth/http/public/login.go

@@ -225,7 +225,7 @@ func (a *PublicRouter) login(r *http.Request) http.HandlerFunc {
 	if h = a.validateClientAccountBinding(client, account); h != nil {
 		return h
 	}
-	if a.flow != nil {
+	if a.factors != nil {
 		return a.beginLogin(r, account, req.SessionIdentifier, randomKey())
 	}
 	return a.respondPendingLogin(account)