Would you trust EEG signals as a second factor for authentication?