When is 2-step verification required?