2FA Error Handling on Google Authenticator

Summary

While searching for bugs in a recently launched 2FA feature, a security researcher discovered that client-side error handling for 2FA was incomplete and could cause confusing results for users. When 2FA failed, there was no error message returned to the client and the login progress spinner continued without interruption. Thanks to this report by @japzdivino, we found and resolved the problem.