"not a biometric policy, then control transfers to step 2516. In step 2516, the second element is either a biometric or a non-biometric device. The user is tested on the second element and the result indicates whether the user passed or failed the" . . . .