A supplier of marketing and logistics web sites has been approached by a customer wanting to incorporate multifactor authentication. What approach should be taken and how should it be configured so as not to disrupt existing customers?