Token + authenticator code · session cookie on this device