Comment Server side HTTP (Score 1) 113
If your users are being equipped with 2FA client devices (or apps), an easy way to apply this security to a website is with the mod-authn-otp Apache module (disclaimer, I wrote it).
In any formula, constants (especially those obtained from handbooks) are to be treated as variables.