Anyone can login a spur account by gmail & password, no authentication needed.

It might be a reason of information leak. So we need 2-factor authentication option and if you provide that option we don't have change password multiple time