code: func (s *AuthServer) CreateUserWithoutOTP(token string, password string) (services.WebSession, error) {
  	authPreference, err := s.GetAuthPreference()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	if authPreference.GetSecondFactor() != teleport.OFF {
  		return nil, trace.AccessDenied("missing second factor")
  	}
  	tokenData, err := s.GetSignupToken(token)
  	if err != nil {
  		log.Warningf("failed to get signup token: %v", err)
  		return nil, trace.AccessDenied("expired or incorrect signup token")
  	}
  
  	err = s.UpsertPassword(tokenData.User.Name, []byte(password))
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// create services.User and services.WebSession
  	webSession, err := s.createUserAndSession(tokenData)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return webSession, nil
  }
docs: // CreateUserWithoutOTP creates an account with the provided password and deletes the token afterwards.