fix enforced MFA
Created by: melanger
- allow enforced MFA even when only password is requested (it is expected that password is a part of MFA, therefore password/SFA may be asserted when doing MFA)
- do not enforce MFA if already done in proxy mode (previously MFA was enforced even if already done)