Password-less two-factor authentication using scannable barcodes on a mobile device