The two factor authentication method is very good. However with regards to the API, from my past experience of API keys it seems that they may not provide the most secure action as when a key i exposed in a hack it can be used indefinitely until a new API key is generated in order to replace that. Therefore using this as a security measure will prove to be good if the API key is regenerated every few days or so, to maintain the security of the wallet.
My wallet private keys are secure and I as well used password.
Two-factor authentication is very important, and I try to stay away from any wallet or any exchange that does not have this feature, because then it means that anyone can access your account if they know your email address and password. The thing that I like with the authentication as well is that you have to actually approve the new IP address that is trying to access your account, so you can be notified whenever there is an attempt as well.
This is a very good way to save your password in case you forget your lengthy password because this is almost in the form of a code that only you will be able to understand. Which is very good and helpful in terms of security. I tend to use lengthy passwords that no one would guess as well, but I have not been able to find a good way to remember and keep track of it but your abbreviation system seems very good.
I would have shown you an example but am still being security conscious. So far the only disadvantage i have is that some account give space for only password of about 7-8 character and i have to reduce my password hence looking for a short password and also creating a different abbreviation