Comment by jun_lung

For auth, how does this handle things like 2FA or cases where, for first login from a new IP/whatever, there's an extra verification step (email, etc)