2FA shouldn’t be treated as optional anymore