Credentials are checked on the server. Sessions expire after 8 hours. Two-step verification arrives with production authentication.