After manual testing there are following edge-cases that need to be handled:

• close existing MFA session when authorizing a new MFA session (this could happen in case of a client failure for example)
• improve detecting inactive sessions in HA scenarios (after a failover happens the old gateway keeps sending stats with an old handshake as there's a small transfer since it keeps trying to perform a handshake)