allow steward logins via TOTP and UUID