Some time ago I started implementing something like this, only to realise that my IMAP server happily accepts only password, without any extra 2nd factor. Wondering if above is still an interest to anyone?