PyPI security work: multifactor auth progress & help needed

[sumanah (Sumana Harihareswara)]

@sumanah

Future: In the future, PyPI will set and enforce a policy requiring users with two-factor authentication enabled to use API tokens to upload (rather than just their password, without a second factor). We do not yet know when we will make this policy change.

More on this in a more recent discussion.