Don't refresh otp_secret if already activated google 2FA