It's still possible to "mess with the URL" .. you just go type paypal.com again and it won't show the phone number request the second time. So this number reque

It's still possible to "mess with the URL" .. you just go type paypal.com again and it won't show the phone number request the second time. So this number request seems to be part of the login flow, but the session cookie is created regardless. My PayPal account still doesn't have a phone number associated with it.