restrict the maximum number of mfa methods to 8