The absolute brain damage that developers have sustained when being subjected to "login expired" messages at a formative age without anyone telling them that this is not normal and should not be emulated.

Just now: "Your login session has expired, please log in again" … "another device is logged in to the account, please enter the token code shown on the other device".

So… the device is logged out because it might be untrusted, but is also the root of trust for new logins?

Cool.