Tag: two-factor authentication protects against session hijacking