Default Authentication Flow + MFA

[Klingenstein, Nate]

Users need to be able to authenticate through a Password page.  This is not the default.

Users also need to be able to authenticate through MFA, which involves RemoteUser + Duo.  This should be the default.

Reading

https://wiki.shibboleth.net/confluence/display/IDP30/Authentication

I find:

3)  Is specific custom Principal support requested or indicated as a default?

a. If yes, choose the first potential flow compatible with the request and execute it (or if it's already active, reuse it). An option is provided to prioritize active results over inactive flows (this is a current V2 behavior that is not SAML compliant).
b. If no, check for a currently active result and reuse it. Otherwise select a potential flow and execute it.

Two questions:

1)  What does "select a potential flow and execute it" mean?  Do I have to get into the weight map thingy?
2)  Is it smartest to try to script all of this into a single MFA blob, or leave the Password flow alone?