Authenticator / recovery code

No self-signup. Ask an admin for an account or a password reset.