made sts credentials directly accessible
added accessor for user's mfa devices