Users attempting to disable two-factor authentication receive an error saying "invalid request." The form appears to send the correct data, suggesting the server endpoint has a bug or misconfiguration in permissions.