then...

"we'd use the token, but for important operations, a password would be asked"

people just don't understand what they write ;)