Allow listing of second factors

Dep: https://github.com/SURFnet/Stepup-Middleware/pull/17