In high-security situations, the only requests that should be granted are ones delivered in person or with a strong form of authentication—for example, two separate items such as a shared secret and a time-based token.