Make 2FA spec only care about 2FA stubbed request