Minor fix on Confirm Middleware

Just a heads up. The 2fa.confirm middleware had an undocumented option for taking into account safe devices, which is a moot point since the logic already remembers the challenge (3 hours default).

This parameter has been removed, along with that duplicated logic.