Is there a way to make users authenticate when signing into the app on a new phone?  Am I missing something?  I've been testing with two phones.  An android and an iphone.  I enroll on the android and then sign into the iphone.  It does not ask to authenticate before signing in.  The iphone shows up as an enrolled device under that user account.  That means if an attacker has the password, they can sign into a new device with the server details and now that device is enrolled and can receive push notifications.  There no way this is should be allowed.  What am I missing???