send people to /two-factor-sms instead of /two-factor

both routes are already valid, however, the link from sign-in sends to
the old link. it fetches whichever URL is second in the route decorator
list when you call `url_for`. Swapping the order around keeps the routes
valid but starts pointing users to the new url.

tests/app/main/views/test_sign_in.py

@@ -130,8 +130,6 @@ def test_process_sms_auth_sign_in_return_2fa_template(
             'email_address': email_address,
             'password': password})
     assert response.status_code == 302
-    # TODO: remove this assert once we start defaulting to returning two_factor_sms first
-    assert '/two-factor-sms' not in response.location
     assert response.location == url_for('.two_factor_sms', next=redirect_url, _external=True)
     mock_verify_password.assert_called_with(api_user_active['id'], password)
     mock_get_user_by_email.assert_called_with('valid@example.gov.uk')