Invalid username or password notification stays if a 2FA token is required

[stevehansen]

If your user has a 2FA token set and you first enter the wrong password, the notification will stay when you need to enter the 6 digits, which gives the wrong impression that the password was still invalid.