check for twofactor requirement