[jonknee]

Who says it's optional? I make primarily B2B web apps, it's very easy to require all users begin using two factor auth.