This prevents a redirect loop when a user has to enable 2FA and accept
the terms.

Now they will need to accept the terms, then enable 2FA, or any other requirements.