Users are directed to TFA overview regardless of 'setup own tfa' permission