As email has gone away as a validation method for 2fa we need to make sure that either Token or Mobile is required before a user can be submitted and email is set to non-required.