MFA flow, Duo, and querying enrollment status

[Cantor, Scott]

> We did it like Jim except on 3.3 we rolled our own (read: backported 3.4 code)
> HTTP client and built a DuoEnrollmentPredicate class.

To continue beating, my point was solely that if you use somebody's HTTP client code who isn't in the business of making HTTP clients, you have to make sure they honor timeouts. Supporting them in the API is sadly insufficient proof of much. If Duo's does, great, just make sure before throwing it in the mainline.

-- Scott