Don't require bots to have Two-Factor auth...

Bots are long-lived, and getting someone to take responsiblity for the
account (and the associated device) is problematic at the moment.