Also allow 'keyboard-interactive' as a valid two factor auth. We don't use password as a second prompt, but do use 'keyboard-interactive' as a secondary prompt