https://www.akku.work/blog/to-implement-or-ignore-mfa-for-custom-apps-websites/