Login flow is hard to grok

[tgulacsi]

Hi, I've made a 2FA (using https://github.com/PHPGangsta/GoogleAuthenticator),
and the hardest part was to understand that

1. Iogin_page.php is called first, always
2. this is followed by login_password_page.php, or what is set in AuthFlags->login_credentials_page,
3. which must have it's own checking (post to it's own page), before
4. it shall pass to the original login.php at last.

not bad and totally understandable, but was two days to decipher and try-and-error.