Add Humble Bundle exception

For #704. It would be great if someone could confirm that TFA can be bypassed using the forget password flow.