A web application currently uses password-only authentication. Explain how you would redesign the authentication system to improve security while maintaining usability.