Only show the OTP bits if configured on the account, in a secondary login step