eff it, if we can't use the twofactor man-in-the-middle everywhere, might as
well not use it at all