Even though it adds an extra step to the login process, the security benefits fully justify this practice.