How to prevent weak MFA session token theft