For good reason. It gives you more flexibility for when to throw login challenges to mitigate credential stuffing attacks.