MFA can be skipped after a logout in the same browser wher user has been previously logged in. The suspected problem lies in the mismatched name of a parameter holding information about successful MFA authorization. This parameter is set when user logs in, but a different parameter is emptied when the user is logged out. This results in a forgotten value about successful MFA which makes it to the subsequent login and allows the user to skip MFA by reloading the tab in bowser.
closes PRX-253