The authenticator can now receive additional questions from the server even after the original password-query.