I dont think this is necessary at all. In fact, The existing MFA extractor I think should be removed entirely. Rather than putting this into a request attribute, why aren't we just using the swf context directly?