Where does the `Cms` namespace come from?  

The changed conditional here will always return `true` which isn't what we'd like.  This check should be redirecting to the MFA check page if value of `current_user` isn't the value held in the `user_mfa_session`.