Florian Duguet authored Feb 20, 2019 and Romain Bignon committed Apr 20, 2019

they have removed captcha, but added an otp at first login
then use password for other attemps, so we use a StatesMixin

Closes: 36486@sibi 36670@sibi 36669@sibi