Instead of cleaning the URL here, you could simply pass it as is to the constructor of `DefaultMultiFactorAuthenticationSupportingWebApplicationService`. Then have the constructor clean up the url, since it will have access to the parent's `cleanupUrl`. Less duplication.