require valid phone before 2fa is enabled