[ TWO-FACTOR AUTH ]   ENABLED [ KIOSK DEVICES ]   long-lived read-only sessions for the Pi / wall display [ TRUSTED DEVICES ]   phones / laptops that stay logged in (full access) [ LOG OUT ]