A few years ago I had the experience of having a login page with two-factor auth for a client. We had to get creative.