Fix bad merge for headers
Make 2FA spec only care about 2FA stubbed request