Researcher finds LastPass 2FA could become 1FA