See https://discourse.phabricator-community.org/t/duo-broken-in-2019-week-12/2580/.
The "live update Duo status" endpoint currently requires full sessions, and doesn't work from the session upgrade gate on login.
Don't require a full session to check the status of an MFA challenge.