            it 'logs in correctly' do
              post "/session/email-login/#{email_token.token}", params: {
                second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
                second_factor_method: UserSecondFactor.methods[:totp]
              }

              expect(response).to redirect_to("/")
            end
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.