return MFA information from /auth API