So 2FA is a protection against the server's admin? Not even the user's protection but the webmaster's one?