change how "has OTP-authenticated" is stored

1. store data in $_SESSION rather than preferences
2. store the time of last OTP auth, rather than a temporary flag
Merge pull request #4 from rjbs/session-storage

change how "has OTP-authenticated" is stored by rjbs (Ricardo Signes)