Requiring Two-Factor Authentication for All Users