message order for GSPM payload and PACE method specific payloads, 
max GSPM payloads not defined, but described in RFC as:
the number of GSPM payloads is up to the secure password method but
usually will be less than 3