I know this is a bit of an old thread, but I recently noticed a security vulnerability with your authentication model. I noticed the issue while trying to "figure out" a way to bypass your-factor auth for my locked account. I have also confirmed that this issue is part of your overall auth...