Describe the bug

When a user has been locked out and needs to use to use their factor backup codes, they are unable to because once they use the backup code it will still ask for their U2F key, meaning that the entire backup code is just completely useless

To Reproduce
Steps to reproduce the behavior:

Expected behavior

to not be asked for my U2F key

Who is affected by the problem?

All U2F key users

What is the impact?

the lost 2FA recovery mechanism is useless

What is the proposed priority?
urgent