Support MFA

[exavolt]

Few scenarios:

• User opted to use MFA all the time (deployment is configured to let users utilize MFA)
• A deployment is configured to force all users to use MFA
• Additional factor is required for unsound authentication attempts (see Require an additional authorization through a secondary channel for unsound terminal authorization attempts #27 )