MFA result reuse with Duo.

[Scott Koranda]

> Remember that the UsernamePrincipal is
> based on what the user enters, not on the result of c14n. I
> keep harping on that, but my deployment for example would
> break based on reusing the UsernamePrincipal's value.

Understood. I was in a hurry to prove out the favorSSO=false
idea but now I can go back and be careful about getting the
canonicalized subject name.

Thanks much,

Scott K