All users sign in with password, then bind Google Authenticator on first login.

Username intentionally starts blank here. Use your assigned account, then complete GA binding on first login.