otp: display notice if GD is missing
do not use session cookie lifetime for additional cookies