Move this all up to the parent. Effectively, all extractors that deal with mfa should do this, so lets not leave that responsibility to extensions but let the parent enforce it always.