Bug fix + two new PAM options

There seemed to be an off-by-one issue, if your OTP ends up being 64 chars long.  I think this occurs when you reprogram with the max UID length possible.

Also added single prompt entry for passcode+OTP.  This works with at least i3lock screensaver, and probably others that depend on having a single response.

The other option, discreet_prompt, just makes the prompt "Password: " for a little obscurity.