Fix session disabling of TwoFA