AMR should mostly be treated as extra information on top of ACR. It
should not allow to use specific auth method