supply 2fa_status when recreating session from cookie