pub const MFA_PENDING: &str = "pending";
Password verified, but a second factor is still required before access.