Require2Factor is not
set to disabled, then the user must provide their static password as a
prefix to their one-time password. The correct static password is returned
by AuthSelect. If the user provides a static password
prefix, then the static password is always checked regardless of
Require2Factor setting.