responsible for web application security at a large insurance company. one of the applications that he is particularly concerned about is used by insurance adjusters in the field. he wants to have strong authentication methods to mitigate misuse of the application. what would be his best choice