Make sure bad credentials doesn't mean user has 2FA.

@rogerhutchings Mergey merge =)