tfa 7.x-2.1

Although this is not a security release, this release hardens the code against timing attacks on the code validation. We recommend that all users upgrade to this version. Releasing this a normal release was agreed by the security team.

Changes since 7.x-2.1-rc1:

• #3183248 by jcnventura, greggles, Mingsong: Prevent timing attack on code validation

Additional changes since 7.x-2.0:

• #2687021 by petar.kolicov, jcnventura, pjcdawkins: TFA redirects to 404 if ?destination includes query parameters
• #2820710 by nullkernel, pjcdawkins, DamienMcKenna, jcnventura, andyrigby, robpowell: Mcrypt is required, but it is deprecated in PHP 7.1+
• #2868526 by nileshlohar, DamienMcKenna: use $t = get_t() to retrieve the appropriate localization function