A user goes to your website. A session$-$based system authenticates this user to provide them access to restricted resources. To increase security in this scenario, an authentication token should meet which of the following requirements?

$-$It should utilize two factor authentication

$-$It should identify returning users to the site

$-$It should be used as a replacement for a user's credentials.

$-$It should always use a persistent cookie