Two-factor access — password + Google Authenticator code.
6-digit code from Google Authenticator (refreshes every 30s).