For users who have multifactor auth set up prior to August of 2019, we need to force them to create a new auth factor / delete the old one.
To do this, the proposal is to redirect them to the settings page and provide instructions on how reset their second factor.
When an affected user logs in, I've modified the multifactor prompt to display a warning:
After completing the TOTP prompt, the user will be redirected to the multifactor configuration settings UI, which should look something like this:
