How to enforce re-authentication for sensitive operations?