[WIP] use 2fa directly instead of auto-preauth strategy