Chrome users could submit the form multiple time by entering the TOTP
code and then pressing Enter key, or clicking the onscreen submit
button. This would be less likely on low latency connections (because
auto-submit would complete before the user presses Enter key) but quite
doable on high latency connections.
The fix is to attach an event handler to form's "onsubmit" events.
The handler lets the first event through, and call preventDefault()
on subsequent events. This takes care of:
* programmatic submits by calling form.requestSubmit()
* Enter key in an input field
* click on the onscreen submit button
