Users should have to opt in to enable MFA. This ensures that the user agrees to the semantics of merging multiple `Authentication` instances. Related gh-18112
