session: allow identity validated users to disable two-step auth using their phone