The 'enoughfactors' should only take into account factors that the user can control

[brendanheywood]

There is 2 parts to this:

• [ ] factors which you can setup AND has setup, eg totp
• [ ] we also need to factor in factors which the user will always pass, but has no control over, eg auth type. Need a new method, not sure what to best call this. Possibly one way of handling this is that we have a method which returns all the possibly states this factor could return, including fail, in the context of this specific user. Auth will only ever return a single state for any given user.