Use :database_authenticatable strategy to check password for OTP user

This:
* makes sure that after_database_authentication is called for users with
enabled 2fa.
* handles paranoid mode correctly