Securing your account: two-factor and sessions