Add a grace time to allow new sessions to not require two-factor authentication, if a session was recently opened.