added second factor capability

I don't love the test, but I'm not sure how to test what headers it's sending