Move "invalid 2FA code" error message to the flash

This makes it consistent with the Invalid email/password error message
from the previous step.

app/controllers/sessions_controller.rb

@@ -63,7 +63,7 @@ class SessionsController < Devise::SessionsController
 
         sign_in(user)
       else
-        @error = 'Invalid two-factor code'
+        flash.now[:alert] = 'Invalid two-factor code.'
         render :two_factor and return
       end
     else

app/views/devise/sessions/two_factor.html.haml

@@ -4,9 +4,6 @@
       %h3 Two-factor Authentication
     .login-body
       = form_for(resource, as: resource_name, url: session_path(resource_name), method: :post) do |f|
-        - if @error
-          .alert.alert-danger
-            = @error
         = f.text_field :otp_attempt, class: 'form-control', placeholder: 'Two-factor authentication code', required: true, autofocus: true
         %p.help-block.hint If you've lost your phone, you may enter one of your recovery codes.
         .prepend-top-20