Fixed a few off-by-one string issues.  These prevented a full length
Yubikey OTP (64 characters, with max UID set) from being used.