add note about 2FA