update_institution_login_explicit_refresh could return an MFA so we should parse the response using update_credentials_data_to_hash