Also adds test case for providing an invalid 2FA code and then a valid
one without re-entering username and password.