Google Authenticator verification is required for every user. Sessions expire automatically after 24 hours.