Using correct session instance to report error messaging when two-factor fails