Add clarification that 2FA auditing requires *owner* account