feature: move password-based auth into sandbox

More info: At the login screen, a user inputs username or email, without providing a password. Next, the portal redirects the user into a sandbox. The sandbox supports password and mfa authentication types. In the future, it will support email-based OTP. Further, it will allow dropping the password and authenticating with HOTP/TOTP only.

Partial Resolution: #173