how to do auth in a way that’s safe for
High risk users