Why do I sometimes have to use multi-factor authentication when I’ve already logged in?