check session file permissions
MFA: inherit nocache behavior from auth-user-pass
added missing ifdefs