Pass the principal object instead of only the username

Having the entire principal available to the multi-factor classes gives
us the flexibility to check for specific values in the user’s
attributes when determining MFA requirements