[#8118] don't expose any multifactor endpoints if TOTP isn't on
2 files changed