Yes that works okay.
If that is the flow, something should we displayed after a user clicks Activate on a new account. Tell the user they need to login to setup two factor authentication.
There is a situation with W3TC where even with all caches off, it doesn’t complain that some of its files are left in WP-Content. That was causing this weird behaviour.
In the end, I could not get W3TC to work with our login system.
Switched to WP Super Cache and all is well.
