Disallow add_creds with != 1 factor.
Disallow add_creds with != 1 factor.

Since we don't have a way to signal which factors were added and
which were not, it seems better to just not accept more than one
factor per request until this has been thought through.

SUNET/VCCS