more general 2FA configuration via priv/tfa.cfg