add MFA to notification message
check MFA in tests