Don't automatically authorize user as an admin when hitting the j_spring_security_second_factor url without a sig_response to check.