Enforce 2FA on /settings email update