Two-factor authentication and session duration as added access controls