2 factor authentication
Just been chatting with the support guys ... When turning on 2FA, the first log in prompts for the auth code. However, every login after that drops back to just asking for username/password. (unless you clear your browser down every time !)
for 2fa to be effective, the system should ask for the auth code at every login otherwise there is no point in enabling it.