doc: handling 2-factor auth