user can be set to mfa=true even if the binding action fails

Need to review when the user mfa=true/false is set as part of the binding to ensure that if there is a failure or the binding is not completed, mfa=false.
Currently its possible to fall into a state where UE Auth things MFA is enabled but the user does not have the binding.