I just set up username/password and 2FA and was able to:

• logout
• loging in through my secret login link
• devest BTC
• placing a bet

without giving another authentication then the initial secret login link.

An 'advanced security' menu in the 'account' section would be great. There you might be able to select which actions (loging in/divesting/betting) require which authentication (secret link/password/2FA).