forceAuthn with DUO

[Cantor, Scott]

The initial-authn feature was already removed from the next version. I don't remember whether it honors ForceAuthn. I seem to recall it didn't at one point, which would probably explain what it's doing, but all that really matters is that it's dead.
 
You need to start over from scratch with the MFA feature, unfortunately. By default any login flow run subordinate to that mechanism will honor ForceAuthn unless something more complex is desired.
 
-- Scott