update two-factor