Only try to create a challenge if the user has TFA enabled