code: func (api UsersAPI) SetupTOTP(w http.ResponseWriter, r *http.Request) {
  	username := mux.Vars(r)["username"]
  	values := struct {
  		TotpSecret string `json:"totpsecret"`
  		TotpCode   string `json:"totpcode"`
  	}{}
  
  	if err := json.NewDecoder(r.Body).Decode(&values); err != nil {
  		http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
  		return
  	}
  	totpMgr := totp.NewManager(r)
  	err := totpMgr.Save(username, values.TotpSecret)
  	if err != nil {
  		log.Error(err)
  		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
  		return
  	}
  	valid, err := totpMgr.Validate(username, values.TotpCode)
  	if err != nil {
  		log.Error(err)
  		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
  		return
  	}
  	if !valid {
  		err := totpMgr.Remove(username)
  		if err != nil {
  			log.Error(err)
  			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
  			return
  		}
  		w.WriteHeader(422)
  	} else {
  		userMgr := user.NewManager(r)
  		userMgr.RemoveExpireDate(username)
  		w.WriteHeader(http.StatusNoContent)
  	}
  }
docs: // SetupTOTP is the handler for POST /users/{username}/totp/
  // Configures TOTP authentication for this user