exclude oauth clients & app passwords from mailbox tfa

data/web/inc/prerequisites.inc.php

@@ -131,7 +131,7 @@ class mailcowPdo extends OAuth2\Storage\Pdo {
     $this->config['user_table'] = 'mailbox';
   }
   public function checkUserCredentials($username, $password) {
-    if (check_login($username, $password) == 'user') {
+    if (check_login($username, $password, false, true) == 'user') {
       return true;
     }
     return false;