Password first, then your authenticator.
Every attempt on this page is logged with its address and time.