Require 'cgi', rotp needs it for encoding parameters

Turns out that the latest version is rotp is using CGI for encoding params, so without it 2 specs are failing on my machine.

I could either just require it on spec_helper or require it inside active_model_otp.. I think that the later is better.

Also fixed a test that was failing sometimes, OTP can return codes with 5-6 digits. The test was asserting that the code could only have 6.