Two-factor scripts depend on /vendor paths being web-accessible

[kadamwhite]

The two-factor auth plugin expects to be installed as a normal WP plugin (or MU plugin), and there are some issues with generating the correct URLs for the plugin modules in a subdirectory multisite environment. Additionally, if for whatever reason the /vendor directory is not accessible over HTTP due to client domain configuration, the two-factor system does not work at all.

It would be helpful to have some way to "proxy" the scripts, or load them from a virtual route within the site domain, rather than hitting vendor/ directly.