how to do auth in a way that’s safe for High risk users