Facebook two-factor authentication without a phone number