2FA scratch token is wrong, but regenerated tokens are good

[SagePtr]

• Gitea version (or commit ref): 1.8.0, ade88a8
• Git version: any
• Operating system: any
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (can't provide URL)
• Log gist:

Description

When you enable 2FA, new scratch token is generated and printed in message "Your account has been enrolled into two-factor authentication. Store your scratch token (XXXXXXXX) in a safe place as it is only shown once!".
But for some reason this token is wrong and can't be used, invalid token message appears.
But if you generate new scratch-token, it will be okay and can be used as scratch-token. And message is "Your scratch token is now XXXXXXXX. Store it in a safe place."

Screenshots

[SagePtr]

I found place in code where Scratch Token is generated twice (new one overwrite old one, but old is outputed), if noone is working on this issue - i'll fix and PR in few hours.