Users can still login if they didn't configure an OTP key