FlowAuth 2factor should support a configurable valid window - the default of 0 seconds is probably too strict.