Previously created sessions continue being valid after 2FA activation