bypass two-factor authentication in Android apps and web