only perform 2fa preauth if not in login flow