Signed-in sessions are protected with a password and a code from your phone.