We are missing the shared secret from the fallback display for when a user cannot use a QR scanner when enabling 2FA. I'm not sure how wise it is to display it in full text immediately anyway, perhaps it should be hidden by default.. but as it is, I can't see how the fallback would ever work..