fix how late we delete tokens for 2fa