fix two step auth bug