Improving user authentication on the web: Protected login, strong sessions, and identity federation