verify whether a user has two-factor authentication enabled