If we know a user is legitimate, then why would we want to make their user experience more challenging?