verify_ticket: allow general non-challenge tfa to be run as two step call