use 2fa directly instead of auto-preauth strategy