Not sure about `final` here. 

You see, this class ties the code to cas-addons, which is fine and per contract. However, while we should support it, we shouldn't harden the dependency. An adopter could potentially want to use a different way of associating the mfa attribute with a service, besides a json attribute.So, 

- lets remove final from here
- lets encapsulate the retrieval of authn method attribute into another method that can be extended.