fix two-factor configuration