bug fix otp.php empty otp is valid for two factor auth