Support for "irregular" secret lengths

I realized whilst turning 2FA for Dropbox that they use a secret length
that's not a multiplier of 8, which breaks Go's base32 decoder.