Finally made progress on the two-factor thing. I hate JS
a bit of colour switching and fiddling