Some Cloudabilifications. Redirect the user back to the login screen on failed token, and (pretty much) force a user to set up MFA when they log in without it.