Doc review 9 26 14

This doesn't sound. For simple primary authentication (no MFA), we should have "sessionToken" in the response instead of "stateToken"