Okay, on GitHub you need to use 2 factor authentication to revoke access of an app to your account, but not to add one? Why? This just seems kinda insecure 🤔