They have a free app you can get on your smartphone that gives the one-time password--you don't have to buy the token if you have a compatible phone.

They track the ISP as a measure to combat the hi-jacking of accounts by the RMT's. If they see it has changed since last login, it flags it like that. With the one-time password key, it ignores or bypasses that IP address check.