Re-use TOTPDevice for handling 'OTP disabled'.

There's no point in having a special device that checks if TOTP secret
is set. Let's just do that in TOTPDevice.