Added thoughts on 2 phase login design