Authorize on the same request as when logging in to trigger two-factor