authentication and 2FA theory