also allowing otp requests without explicitly stated agencyId prefix in the requests