Ticket-granting ticket with pending two-factor should timeout earlier