Comment by samuli

You'll need to implement views for handling recovery tokens, processes for people losing their second factor due to stolen phone or corrupted app, and FAQ pages for questions about why my second factor is not accepted.