Curious: when companies run two-factor authentication systems with hardware tokens or authenticator apps on the client, how does the backend look like? How is it typically secured?