It should be possible to enforce that users enable MFA. - in `ApplicationSettings` which applies to every user - in `Namespace` which applies only to members of this namespace