Talked with @iSec about usability issues with the password part for the document interface's 2 factor authentication, but we all felt that having access restricted by something you know is worth the usability trade off.
added example network firewall rules.