When using the password sign-in method, only one user can be signed into the app at a time. Any other active user will be asked to sign out when a new user signs in.
Security? Right now the same user can login multiple devices, while it’s great for testing it’s not secure if certain clients require the single session login.
I don’t think there are many cases that a client, with multiple users of the app will require that only one will be able to use the app at the same time.
Just to be clear, it’s one user being able to login and use the app at the same time (I don’t know if one user can log in from multiple devices in a password-protected app or not), not one device for one user.
If you absolutely need only one user to be able to use the app then on Pro use a whitelist with only one email, but you must find a way to dynamically update it. I’m not aware of a way to require the single session.