More work on two-factor support, including new API for provider UI