I have reworked the two-factor authentication page to require a confirmation and it is now live on .social. Given all the other fixes I am considering tagging a v1.1.1 release right now
@Gargron all tests still passing? :-)