so now people can use dispenser without mobile auth?

http://i.imgur.com/EeKyaqm.png

They are not supposed to. But I think some people bypassed it by changing the authenticator settings right before they accept the trade offer and get into escrow. Our system should be able to handle this situation, though.