Verify enrollment of a user device for authentication using one-time passwords

The second step in enrolling the logged-in user's device for one-time passwords: submit the code the device received to complete enrollment. Once enrolled, the device can verify transactions and step up tokens.

The challenge expires after 5 minutes, and the number of incorrect attempts is capped to reduce the risk of fraud. Once either limit is hit, issue a fresh challenge.