break out OTP library from auth.c into otp.c/otp.h  

no functionality change at this point, but supports other apps ( like APM) using the OTP.