fix: do not prefer MFA at upstream when not preferred at SP

Created by: melanger

Previously, when SP sent SFA,MFA, authswitcher would send MFA,SFA to upstream.

With this fix, it sends SFA,MFA as expected.