The package is now in production in some of our applications. In the first, somewhat naive implementation, OTP authentication was tied to the user, while now it's tied to the session. This way, a user can log in simultaneously on multiple devices, but the OTP is always required.
