Allow disabling two-factor authentication (2FA) by using either their authenticator app (TOTP) or a backup code.