Roll MFA into Auth?

[kevinmichaelchen]

MFA options need to get sent back to client if user types correct password and has multi_factor_required. Since MFA is tightly coupled with the /token logic, we should merge the two services.