validateOTP needs to be thread safe

Fixed a race condition in validateOTP(), it was possible
to overwrite the temporary key while validateOTP() was executing
which could lead to failed OTP validation.