Re-work additional auth token (otp) so that 3rd-parties have not have
to deal it. We manager everything from password key string.