Fix a bug that lead to leaking mfa sessions.