add authenticate_on_login? so that we don't need to send an sms on every login if we don't want to