Enabling and disabling two-factor authentication