Use the user's only mfa device if all else fails

[ztane]

When using mfa for an IAM user access tokens there is only one device; the only result in session.client('iam').list_mfa_devices(). Would be worthwhile to try to default to that if not configured otherwise.