yes, you need to call $login->isTFAEnabled() to see if TFA is enabled, if this is true so you can display the secret field