For additional safeguards, allow a couple-grounds authentication (2FA) if offered