Interesting and disturbing I set up 2 factor with a token in Authy for Paypal a few years back and I never click the 'leave me logged in' link to prevent anything at all like this.