Users are directed to TFA overview regardless of 'setup own tfa' permission

Needs rebase to 2.x

Also the message "You do not have permission to setup TFA. Please contact administrator" would likely be better along the lines of:

"You are required to setup two-factor authentication however your account does not have the necessary permissions. Please contact an administrator. You have @remaining attempt(s) left. After this you will be unable to login." Run through formatPlural() so that users know the risk of not taking action.

Critical change: the hasSkipped() needs to be outside the if/else check as it applies to both those user with and without permission to setup their TFA tokens.

Here is the 1.x patch

The change to TfaPasswordResetTest.php is due to 🐛 TfaPasswordResetTest does not directly test TFA prompts. Active testing for the messages instead of validating the login forms.

Automatically closed - issue fixed for 2 weeks with no activity.