If merged, WordPress/two-factor#586 will add a case where get_available_providers_for_user() returns a WP_Error. We'll need to handle that situation in cases where we call the function.