public function verifyTwoFactor(UserInterface $user, $token, $remember = false)
    {
        $this->getTwoFactorStrategy()->verify($user, $token);

        // mark the user as 2FA verified, now and for the session
        $user->markTwoFactorVerified();

        // the user is now considered fully signed in
        // now we want to perform the sign in so an event is recorded
        // and a remember me token is generated, if needed
        if (!$user->isSignedIn()) {
            $this->signInUser($user, '2fa', $remember);
        }

        $saved = $this->getStorage()
                      ->twoFactorVerified($user,
                                          $this->request,
                                          $this->response);
        if (!$saved) {
            throw new AuthException('Unable to mark user session as two-factor verified');
        }

        return $this;
    }