Create/update test suite to be a passing rspec suite

[rietta]

Some Tests in Definition of Done

• The shared secret is not stored in plain text
• When there is no encryption key, the encryption should fail with a 500 error so that shared secrets are not accidentally left unprotected in the database
• As a user, who has tried to provide the wrong TOTP code 10 times, my account should be locked out just like if I had entered my password wrong too many times to protect me against brute force attacks
  • Trigger the devise lock out mechanism and allow the customer app to handle from there
• As a user, I should not be able to enter the same TOTP code twice even if I submit within the time period that the code is valid
  • Do not need to store previous codes forever since they become invalid over time
  • Should be atomic. Worth creating a special purpose database table.