Yes, I mean: 'Can you make your site use a plain-text cookie to store password and username, and stay logged in indefinitely?'. E.g. Coinbase never logs me out, Cryptsy logs me out twice a day. Cryptsy=annoying, Coinbase=not.

Reserve 2FA for any transactions would could be deemed harmful. From a provider's perspective lowering prices and changing pools are about it. Create a set of trusted pools which require 2FA to change, and email notifications for any price or pool changes. The worst that could happen is someone could try to lower your prices, then rent your rigs for nothing. You would get emails about all of that and be able to terminate the lease immediately. Security can be further improved by logging IPs to transaction records and displaying them in the history.