Logic for mfa-authn-config.xml

[Cantor, Scott]

> I may be restarting what Andrew and Tom already said but AFAIU that
> second group of service doesn't exist: Either the service requires MFA
> (and states that much in its request or in your local config) or it
> doesn't (meaning it will take what it gets).

Usually the third group is "requires MFA but can't ask for it", which includes most cloud services.

-- Scott