One session. A second factor every time.

Accounts are created from an invite. A new sign-in closes the older device.