this is cursed.
short explanation of how this works:
on the final request for totp/webauthn I check if backup codes are there, if not I throw an error 499 with the backup codes in the body and an X-Hangar-Verify header for a OTP (for totp only)
UI detects the 499 and opens the modal, saves the request, sends the backup code (plus the otp for totp) in the X-Hangar-Verify header and backend checks that to confirm the backup codes and let the request thru (to finish the mfa registration)
otp here means jwt
