prompts user for pin if two factor auth enabled