2 factor not being enforced consistently via http

I switched on two factor the other day both for SSH and for WHM access. I have noticed that if I do not click the logout button in WHM when I am done (just close the window) then the next time I go to log into WHM it doesn't ask me for the second factor. Even if it is many hours since the last time I logged into WHM it asks me for my password but it doesn't ask for the second factor unless I have logged out previously by clicking the logout button. Surely this isn't the way it is supposed to work? Is there some way to force it to ask for 2nd factor every time regardless?