mandatory2fa: fix workflow when using external LDAP

* Always allow the mandatory 2fa setting to be saved
* Show warning for user if they have no 2fa setup and if not external 2fa
* If they get locked out anyway, they have to use CLI tool
* redirect for mandatory 2fa only if not external 2fa as well

src/routes/test/user-directory-test.js

@@ -74,7 +74,13 @@ describe('User Directory API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response2.statusCode).to.equal(401); // token is gone
+            expect(response2.statusCode).to.equal(200); // token is not gone, since it is persisted
+
+            const response3 = await superagent.get(`${serverUrl}/api/v1/profile`)
+                .query({ access_token: user.token })
+                .ok(() => true);
+
+            expect(response3.statusCode).to.equal(401); // token is gone
         });
     });
 });