An authenticator code is required next — on every login, no exceptions.