require valid phone before 2fa is enabled
fixed do not allow enabled condition